CVE-2026-41449

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41449

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41449.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41449

Published

2026-08-21T17:33:50Z

Modified

2026-08-23T03:53:38Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

UAC < 3.3.0 Command Injection via run_command.sh

Details

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41449.json"
}

References

Affected packages

Git / github.com/tclahr/uac

Affected ranges

Type

GIT

Repo

https://github.com/tclahr/uac

Events

Introduced

Fixed

2cc367d8ead388f05abd3cfb8af537788a124e72

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*

v1.0.0

v1.0.1

v1.1.0

v1.1.1

v1.2.0

v1.3.0

v1.3.1

v1.4.0

v1.5.0

v1.5.1

v1.6.0

v1.7.0

v2.*

v2.1.0

v2.2.0

v2.3.0

v2.4.0

v2.4.1

v2.5.0

v2.6.0

v2.7.0

v2.8.0

v2.9.0

v2.9.1

v3.*

v3.0.0

v3.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41449.json"