EUVD-2026-64011
GHSA-3v7p-hjjf-gqp8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector since UAC runs on analyst's machine; no analyst privileges required; user interaction is the analyst initiating collection; full host impact with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval. Attackers can inject shell metacharacters such as command substitution syntax or semicolons through crafted usernames or home directory paths in /etc/passwd entries to execute arbitrary commands on the analyst's host system.
AnalysisAI
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 allows an attacker who controls /etc/passwd entries on a target system to execute arbitrary commands on a forensic analyst's host machine. The vulnerability targets the DFIR tool itself rather than the system under investigation: when an analyst runs UAC against a compromised host, crafted usernames or home directory paths containing shell metacharacters are substituted into command strings and passed to eval without sanitization in parse_artifact.sh. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have prior write access to /etc/passwd on the system being investigated - this is a post-compromise capability, typically requiring root or sudo on the target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.5 and accurately captures the attack dynamic: local execution on the analyst's host, low complexity, no privileges required from the analyst's perspective, with passive user interaction (the analyst simply running UAC as intended). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade UAC to version 3.3.0 or later, which contains the fix from commit 2cc367d8ead388f05abd3cfb8af537788a124e72 (PR #443). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all UAC installations and restrict their use against untrusted systems until patching is complete; alert forensic teams of the risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in Unix-like Artifacts Collector (UAC) pre-3.3.0-rc1 enables arbitrary code execution through unsaniti
Command injection in UAC (Unix-like Artifacts Collector) versions before 3.3.0 allows an attacker who controls evidence
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 enables arbitrary command execution on
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today