Command Injection Vulnerability in UAC by Tclahr

CVE-2026-41451

What is CVE-2026-41451?

UAC (Unix-like Artifacts Collector) versions before 3.3.0 exhibit a command injection vulnerability due to improper handling of user input in parse_artifact.sh. The software substitutes usernames and home directories directly from /etc/passwd into command strings without adequate escaping. This flaw allows attackers to manipulate the user data to inject harmful shell metacharacters, leading to the execution of arbitrary commands on the system running UAC. It is crucial for users to upgrade to the latest version to ensure protection against potential exploitation.

References