CVE-2026-41451: UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval. Attackers can inject shell metacharacters such as command substitution syntax or semicolons through crafted usernames or home directory paths in /etc/passwd entries to execute arbitrary commands on the analyst's host system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UACto a version that resolves this vulnerability.Fixed in 3.3.0 - Compensating control
Isolate or restrict execution of UAC/parse_artifact.sh on the analyst host to prevent exploitation via crafted usernames or home directory paths in /etc/passwd entries until the vulnerable UAC version is upgraded.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Analysts running UAC versions earlier than 3.3.0 are exposed when the collection process parses attacker-controlled /etc/passwd content. The injected commands execute on the analyst's host system, not merely on the system from which artifacts are being collected.
What does an attacker need to exploit it?
An attacker needs to cause a crafted username or home-directory path containing shell metacharacters to appear in an /etc/passwd entry that UAC processes. Exploitation also requires an analyst to run the vulnerable collection logic, as reflected by the required user interaction in the severity vector.
How can I determine whether a collection may be affected?
Check whether the UAC version used was earlier than 3.3.0 and inspect relevant /etc/passwd entries for usernames or home-directory values containing shell metacharacters, such as command substitution syntax or semicolons. Such values can be substituted into command strings and executed through eval.
What can be done if upgrading is not immediately possible?
Do not run the vulnerable UAC parsing logic against artifact sets with untrusted /etc/passwd content. Review and remove or neutralize shell metacharacters in usernames and home-directory fields before processing the artifacts.