CVE-2026-40032: UAC Command Injection RCE Vulnerability

CVE-2026-40032 Overview

CVE-2026-40032 is a command injection vulnerability affecting UAC (Unix-like Artifacts Collector) before version 3.3.0-rc1. The vulnerability exists in the placeholder substitution and command execution pipeline where the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user_home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.

Critical Impact

Successful exploitation allows attackers to execute arbitrary commands with the same privileges as the UAC process, potentially leading to full system compromise during forensic artifact collection operations.

Affected Products

• UAC (Unix-like Artifacts Collector) versions prior to 3.3.0-rc1

Discovery Timeline

• 2026-04-08 - CVE-2026-40032 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-40032

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw resides in the placeholder substitution mechanism within UAC's command collector functionality.

The vulnerable code path involves the _run_command() function which constructs shell commands by substituting placeholders such as %line%, %user%, and %user_home% with runtime values. These values can originate from system files or iterator outputs that may contain attacker-controlled content. When these values are passed to eval without proper sanitization, shell metacharacters and command substitutions within the input are interpreted and executed.

The attack requires local access and some user interaction, as the attacker must be able to influence the content of system files that UAC reads during artifact collection, or manipulate data that flows through the foreach iterators.

Root Cause

The root cause is the use of simple string substitution via sed to replace placeholders directly into command strings that are subsequently passed to eval. The original implementation used constructs like:

__cc_new_command=`echo "${__cc_command}" | sed -e "s|%line%|${__cc_line}|g"`

This approach fails to escape special shell characters in the replacement value (${__cc_line}), allowing malicious input containing characters like backticks, $(), semicolons, or pipes to be interpreted as shell commands during the eval execution.

Attack Vector

The attack leverages locally accessible input vectors including system files that define user accounts and home directories, or data processed through foreach iterators. An attacker with the ability to create or modify user account information, home directory paths, or other data sources consumed by UAC's collection profiles can inject malicious payloads.

For example, if a system user's home directory path or username contains embedded command substitution syntax like `malicious_command` or $(malicious_command), this payload would be executed when UAC processes that entry during artifact collection.

The following patch demonstrates how the vulnerability was addressed by replacing the unsafe substitution with properly escaped placeholder handling:

       | while IFS= read __cc_line && [ -n "${__cc_line}" ]; do
 
           # replace %line% by __cc_line value
-          __cc_new_command=`echo "${__cc_command}" | sed -e "s|%line%|${__cc_line}|g"`
-          __cc_new_output_directory=`echo "${__cc_output_directory}" | sed -e "s|%line%|${__cc_line}|g"`
+          __cc_new_command=`_replace_eval_safe_placeholder "${__cc_command}" "line" "${__cc_line}"`
+          __cc_new_output_directory=`_replace_plain_placeholder "${__cc_output_directory}" "line" "${__cc_line}`
           
           __cc_new_output_directory=`_sanitize_output_directory "${__cc_new_output_directory}"`

Source: GitHub Commit Fix

The fix introduces dedicated functions _replace_eval_safe_placeholder and _replace_plain_placeholder that properly escape shell metacharacters before substitution, preventing command injection.

Detection Methods for CVE-2026-40032

Indicators of Compromise

• Unusual process spawning patterns during UAC execution, particularly unexpected child processes
• System files containing suspicious shell metacharacters in user account fields, home directory paths, or other UAC-consumed data sources
• Anomalous command executions occurring during forensic collection timeframes
• Unexpected network connections or file modifications during UAC artifact collection runs

Detection Strategies

• Monitor process execution chains for unexpected commands spawned as children of UAC processes
• Audit system files (e.g., /etc/passwd, user directories) for entries containing shell metacharacters or command substitution syntax
• Implement file integrity monitoring on system configuration files that UAC consumes during collection
• Review UAC execution logs for signs of command injection attempts or unexpected command output

Monitoring Recommendations

• Enable comprehensive process auditing on systems where UAC is deployed for forensic collection
• Configure SentinelOne agents to monitor for suspicious process trees originating from shell scripts during known forensic collection windows
• Establish baseline behavior for UAC executions and alert on deviations from expected command patterns
• Monitor for privilege escalation attempts coinciding with UAC execution times

How to Mitigate CVE-2026-40032

Immediate Actions Required

• Upgrade UAC to version 3.3.0-rc1 or later immediately
• Review any systems where UAC has been executed for signs of compromise
• Audit system files for potentially malicious entries containing shell metacharacters before running UAC on untrusted systems
• Consider running UAC in an isolated environment when collecting artifacts from potentially compromised systems

Patch Information

The vulnerability has been addressed in UAC version 3.3.0-rc1 through a series of commits that introduce proper input sanitization for placeholder substitution. The fix replaces the unsafe direct string substitution with dedicated escaping functions:

• GitHub Commit Update - Introduces _replace_placeholder_shell_fragment and _replace_placeholder_plain_text functions
• GitHub Commit Fix - Initial implementation of _replace_eval_safe_placeholder
• GitHub Commit Change - Further hardening of the escape mechanism

Additional technical details are available in the GitHub Issue Discussion and GitHub Pull Request. The VulnCheck Advisory provides comprehensive vulnerability details.

Workarounds

• If immediate upgrade is not possible, run UAC only on trusted systems where user account data and system files have been verified as clean
• Execute UAC in a containerized or sandboxed environment to limit the impact of potential command injection
• Pre-validate any system files that UAC will consume during artifact collection, sanitizing entries containing shell metacharacters
• Implement strict access controls to prevent unauthorized modification of system files that serve as input to UAC

# Verify UAC version before use
./uac --version

# Update to patched version
git clone https://github.com/tclahr/uac.git
cd uac
git checkout v3.3.0-rc1