Command Injection Vulnerability in UAC by Tclahr

CVE-2026-41450

What is CVE-2026-41450?

The UAC (Unix-like Artifacts Collector) prior to version 3.3.0 is susceptible to a command injection vulnerability within its _command_collector function. This flaw arises when output lines from the foreach command are directly inserted into command strings using sed, lacking adequate escaping measures before evaluation through eval. Attackers can exploit this weakness by creating crafted filenames or artifact definitions infused with shell metacharacters, including command substitution syntax or semicolons. This could enable execution of arbitrary commands on the analyst's host system, posing a significant security risk.

References