EUVD-2026-64010
GHSA-2p5p-hghg-98jw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because UAC runs on the analyst's local host; PR:N as the attacker needs no privileges on that host; UI:R as the analyst must actively run UAC against the crafted evidence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons to execute arbitrary commands on the analyst's host system.
AnalysisAI
Command injection in UAC (Unix-like Artifacts Collector) versions before 3.3.0 allows an attacker who controls evidence under forensic analysis to execute arbitrary commands on the investigating analyst's own host system. The _command_collector function substitutes placeholders such as %user%, %user_home%, and %line% into shell command strings via sed without sanitizing shell metacharacters, then passes the result to eval - enabling malicious filenames or artifact definitions to inject and execute arbitrary shell code on the analyst's workstation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the analyst must be running UAC version prior to 3.3.0 on their own host, and (2) the evidence being processed must contain filenames, user home directory paths, or artifact definitions that include shell metacharacters such as command substitution syntax ($(...) or backtick sequences) or semicolons. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.5 (AV:L/AC:L/AT:N/PR:N/UI:P) reflects high impact constrained by a local attack vector and passive user interaction requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to UAC 3.3.0 or later, which resolves the injection by introducing proper quoting of the %user%, %user_home%, and %line% placeholders and sanitizing path strings across artifact YAML definitions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running UAC versions prior to 3.3.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 allows an attacker who controls /etc/pa
Command injection in Unix-like Artifacts Collector (UAC) pre-3.3.0-rc1 enables arbitrary code execution through unsaniti
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 enables arbitrary command execution on
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today