EUVD-2026-93419Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N and UI:R because malicious input reaches the agent remotely but a user must run the workflow and the tool call must be induced; AC:H for those dependencies; PR:N as the attacker needs no account; C/I/A:H for full code execution as the desktop user; S:U.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the bash_command parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attacker-influenced agent call can launch an arbitrary executable or script as the desktop user even though the subprocess uses shell=False. Exploitation depends on a user running an affected agent workflow and on inducing the tool call, but successful execution can access or modify that user's files, tokens, and sessions. This issue is fixed in version 3.0.9.
Articles & Coverage 2
AnalysisAI
Argument injection in Microsoft UFO's run_shell tool lets an attacker who can influence an agent workflow execute arbitrary code as the desktop user on Windows systems running UFO prior to 3.0.9. The tool validates only the first token of the bash_command parameter and permits explorer.exe, which then delegates its path argument to ShellExecute - so a crafted call such as explorer.exe "C:\Users\victim\payload.bat" launches an attacker-controlled executable or script even though the subprocess is spawned with shell=False. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires all of the following: (1) a victim actively running a Microsoft UFO agent workflow prior to version 3.0.9 on Windows; (2) the attacker able to influence the agent's inputs and induce a run_shell tool call (attacker-controlled command string); and (3) a bash_command whose first token is the permitted 'explorer.exe' followed by a path to an attacker-controlled executable, script, or UNC share - Windows then delegates that path to ShellExecute, launching it despite subprocess shell=False. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input assigns CVSS 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R, and the C:H/I:H/A:H impact reflects that successful exploitation yields full arbitrary code execution in the desktop user's context - functionally code execution despite the CWE-88 (argument injection) root cause. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Microsoft UFO to version 3.0.9 or later, which is the vendor-released patch; it replaces the inadequate first-token check with a launch-only allow-list that rejects explorer.exe outright and blocks any command containing arguments, so no further configuration is required once the upgrade is applied (see GHSA-cmq9-vqjf-4q2q at https://github.com/microsoft/UFO/security/advisories/GHSA-cmq9-vqjf-4q2q, the fix commit 3e1262fc091eb319253b7a1338b63f62cc6c82b1, and the release at https://github.com/microsoft/UFO/releases/tag/v3.0.9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Microsoft UFO deployment below 3.0.9, confirm which hosts run agent workflows on Windows under interactive user accounts, and temporarily suspend or tightly gate the run_shell capability while restricting who can submit prompts or induce tool calls into those agents. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today