CVE-2026-105791: Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the runshell tool in the CommandLineExecutor component of ufo/client/mcp/localservers/climcpserver.py validates only the first token of the bashcommand parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attacker-influenced agent call can launch an arbitrary executable or script as the desktop user even though the subprocess uses shell=False. Exploitation depends on a user running an affected agent workflow and on inducing the tool call, but successful execution can access or modify that user's files, tokens, and sessions. This issue is fixed in version 3.0.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Microsoft UFOto a version that resolves this vulnerability.Fixed in 3.0.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Windows deployments running Microsoft UFO before version 3.0.9 are affected where an agent workflow can invoke the run_shell tool in the CommandLineExecutor component. The resulting code runs as the desktop user, so the accessible data and services are those available to that user.
What must an attacker do to exploit this issue?
The attacker must induce an affected agent workflow to make a run_shell call with attacker-influenced input. Exploitation also requires a user to run that affected workflow; no attacker privileges are required.
Are shell=False subprocess calls sufficient protection?
No. Although the subprocess is invoked with shell=False, allowing explorer.exe lets its subsequent path argument be delegated to Windows ShellExecute, which can launch an arbitrary executable or script.
What should be done if an immediate upgrade is not possible?
The provided data identifies the vulnerable condition as allowing explorer.exe through run_shell validation. Until upgrading, avoid running affected workflows that can be induced to make attacker-influenced run_shell calls.
How can I determine whether I am affected?
Check whether the Microsoft UFO version is earlier than 3.0.9 and whether your Windows agent workflows use the run_shell tool. Systems updated to version 3.0.9 contain the fix.