CVE-2026-41449: UAC < 3.3.0 Command Injection via run_command.sh
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UAC (Unix-like Artifacts Collector)to a version that resolves this vulnerability.Fixed in 3.3.0 - Compensating control
If you cannot upgrade immediately, prevent untrusted evidence inputs (crafted evidence, mounted images with hostile filenames, and tampered artifact definitions) from being processed by the UAC analyst host until the UAC version is upgraded to 3.3.0 or later.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Analysts running affected UAC versions are exposed when they process untrusted evidence. Successful exploitation can execute commands on the analyst's host.
What attacker-controlled inputs can trigger the issue?
The issue can be triggered through crafted evidence inputs, mounted images containing hostile filenames, or tampered artifact definitions. Untrusted usernames and process names are also identified as injection sources.
What version should be used to remediate the issue?
Upgrade UAC to version 3.3.0 or later. Versions prior to 3.3.0 are affected.