CVE-2026-40032
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-78
Neutralización incorrecta de elementos especiales usados en un comando de sistema operativo (Inyección de comando de sistema operativo)
Fecha de publicación:
08/04/2026
Última modificación:
08/04/2026
Descripción
*** Pendiente de traducción *** UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user_home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.
Impacto
Puntuación base 4.0
8.50
Gravedad 4.0
ALTA
Puntuación base 3.x
7.80
Gravedad 3.x
ALTA
Referencias a soluciones, herramientas e información
- https://github.com/tclahr/uac/commit/50ace60e172e38feb78347bdf579311c23eff078
- https://github.com/tclahr/uac/commit/cb95d7166cd47908e1189d9669e43f9a6d3d707f
- https://github.com/tclahr/uac/commit/d0fca5e36d8d6a33a4404f0f6fe92b0424544589
- https://github.com/tclahr/uac/issues/429
- https://github.com/tclahr/uac/pull/443
- https://mobasi.ai/sentinel
- https://www.vulncheck.com/advisories/uac-rc1-command-injection-via-placeholder-substitution