EUVD-2026-64009
GHSA-wcqh-23xq-vm77
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because exploitation occurs on the analyst's host processing evidence; user interaction required as the analyst must run UAC; no privileges needed on the analyst's system since the attacker's payload rides in the evidence data.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence.
AnalysisAI
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 enables arbitrary command execution on a forensic analyst's workstation when processing evidence containing attacker-controlled data. The root cause is unsafe use of shell eval to expand untrusted placeholders - including %user%, %user_home%, %line%, and %mount_point% - in the _run_command function, allowing shell metacharacters or command substitutions embedded in usernames, filenames, or artifact definitions to execute in the analyst's shell context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that an analyst runs UAC versions prior to 3.3.0 against evidence - a mounted disk image, live system, or artifact collection - in which the attacker controls at least one value that UAC expands as a `%user%`, `%user_home%`, `%line%`, or `%mount_point%` placeholder in a shell command. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.5 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H accurately reflects that while impact on the analyst's host is total (full CIA compromise), the attack is constrained to a local vector requiring user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade UAC to version 3.3.0 or later, which resolves the vulnerability by quoting all untrusted placeholder expansions in shell commands (GitHub commit 2cc367d8ead388f05abd3cfb8af537788a124e72, PR #443 at https://github.com/tclahr/uac/pull/443). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all UAC deployments running versions prior to 3.3.0 and assess exposure through forensic evidence processing logs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 allows an attacker who controls /etc/pa
Command injection in Unix-like Artifacts Collector (UAC) pre-3.3.0-rc1 enables arbitrary code execution through unsaniti
Command injection in UAC (Unix-like Artifacts Collector) versions before 3.3.0 allows an attacker who controls evidence
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today