CVE-2026-41449

HIGH 7.8

UAC < 3.3.0 Command Injection via run_command.sh

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence.

CWE	CWE-78
Vendor	tclahr
Product	uac
Published	Aug 21, 2026
Last Updated	Aug 21, 2026

Stay Ahead of the Next One

Get instant alerts for tclahr uac

Be the first to know when new high vulnerabilities affecting tclahr uac are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

tclahr / uac

0 < 3.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/tclahr/uac/pull/443 github.com: https://github.com/tclahr/uac/commit/2cc367d8ead388f05abd3cfb8af537788a124e72 vulncheck.com: https://www.vulncheck.com/advisories/uac-command-injection-via-run-command-sh

Credits

Mobasi Security Team