CVE-2026-41450

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41450

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41450.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41450

Published

2026-08-21T17:35:04Z

Modified

2026-08-23T03:53:38Z

Severity

8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

UAC < 3.3.0 Command Injection via command_collector.sh

Details

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons to execute arbitrary commands on the analyst's host system.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41450.json"
}

References

Affected packages

Git / github.com/tclahr/uac

Affected ranges

Type

GIT

Repo

https://github.com/tclahr/uac

Events

Introduced

Fixed

2cc367d8ead388f05abd3cfb8af537788a124e72

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*

v1.0.0

v1.0.1

v1.1.0

v1.1.1

v1.2.0

v1.3.0

v1.3.1

v1.4.0

v1.5.0

v1.5.1

v1.6.0

v1.7.0

v2.*

v2.1.0

v2.2.0

v2.3.0

v2.4.0

v2.4.1

v2.5.0

v2.6.0

v2.7.0

v2.8.0

v2.9.0

v2.9.1

v3.*

v3.0.0

v3.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41450.json"