Command Injection Vulnerability in UAC by tclahr

CVE-2026-40032

What is CVE-2026-40032?

The UAC application prior to version 3.3.0-rc1 has a significant command injection vulnerability within its placeholder substitution and command execution pipeline. This vulnerability arises when the _run_command() function passes command strings directly to the eval function without adequate sanitization. Attackers can exploit this weakness by injecting shell metacharacters or command substitutions through manipulated inputs. Specifically, values derived from system files, such as %user% and %user_home%, as well as %line% values from foreach iterators, can allow for arbitrary command execution with the privileges of the UAC process.

References