CVE-2026-41451High· 7.8▾ Twilight

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh where usernames and home directories from /etc/passwd are substituted directly …

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 21, 2026

Updated

Oct 15, 2026

CVSS

7.8

Vendor

—

Product

—

CWE

CWE-78

Depth score

43 · Moderate

EPSS

1.2% · p67

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 24.

1.2% → 1.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 55 days

Aug 21, 2026Published
Disclosed via NVD
Sep 24, 2026EPSS first tracked
1.2%
Oct 15, 2026Record revised
Last analysed / modified upstream

CWE-78 #nvd

Full technical detail▾

Overview

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval. Attackers can inject shell metacharacters such as command substitution syntax or semicolons through crafted usernames or home directory paths in /etc/passwd entries to execute arbitrary commands on the analyst's host system.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed