CVE-2026-76055: OS Command Injection
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan.
Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Black Duck blackduck-c-cppto a version that resolves this vulnerability.Fixed in 3.0.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Scans performed with blackduck-c-cpp versions before 3.0.7 are exposed when an actor can create a file or directory within the build directory being scanned. Commands run with the privileges of the account performing the scan.
Does exploitation require control of the build command or scanner configuration?
No. The actor only needs to place a filesystem path containing shell metacharacters in the scanned build directory; control of the build command or tool configuration is not required.
What should teams check to identify exposure?
Identify blackduck-c-cpp installations running a version earlier than 3.0.7 and determine whether untrusted or less-trusted actors can create files or directories in locations scanned as build directories. Review scan execution accounts, since successful exploitation executes commands under those accounts.