CVE-2026-41450: UAC Command Injection RCE Vulnerability

CVE-2026-41450 Overview

CVE-2026-41450 is a command injection vulnerability [CWE-78] in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0. The flaw resides in the _command_collector function within lib/command_collector.sh. Output lines from foreach commands are substituted directly into command strings using sed without escaping, then evaluated with eval. An attacker who controls filenames or artifact definitions on a target system can embed shell metacharacters such as command substitution syntax or semicolons. When an incident responder runs UAC against the compromised host, those payloads execute on the analyst's collection system.

Critical Impact
Arbitrary command execution on the forensic analyst's host during evidence collection, enabling attackers to compromise incident response infrastructure.

Affected Products

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0
lib/command_collector.sh component
Forensic and incident response workflows using UAC for triage collection

Discovery Timeline

2026-08-21 - CVE-2026-41450 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-41450

Vulnerability Analysis

UAC is a live response collection script used by incident responders to gather forensic artifacts from Unix-like systems. The vulnerability affects how the tool processes foreach directives in artifact collection profiles. These directives iterate over the output of a preceding command, substituting each line into a subsequent command template via a placeholder token named %line%.

The unsafe substitution occurs when UAC builds the next command using sed to replace %line% with the raw content of each output line. The resulting string is then executed with eval. Because attacker-controlled data such as filenames or directory paths can appear in that output, any shell metacharacter in the line is interpreted by the shell.

This creates a supply-side attack path against forensic tooling. An attacker who has planted a malicious filename on a target host can wait for a responder to run UAC, at which point commands execute in the responder's shell context.

Root Cause

The root cause is unsafe string interpolation followed by shell evaluation. The pre-patch code assembles a command by piping the template through sed and passes the result to eval, treating untrusted line content as trusted shell syntax. There is no escaping, quoting, or argument-based invocation.

Attack Vector

Exploitation requires the attacker to influence data collected by UAC. This is typically achieved by creating files with malicious names containing backticks, $( ) command substitution, or semicolons on a target host that UAC will later triage. Execution triggers when the analyst runs UAC against the artifact or the compromised system.

bash

# Pre-patch vulnerable pattern (lib/command_collector.sh)
| while IFS= read __cc_line && [ -n "${__cc_line}" ]; do

    # replace %line% by __cc_line value
-   __cc_new_command=`echo "${__cc_command}" | sed -e "s|%line%|${__cc_line}|g"`
-   __cc_new_output_directory=`echo "${__cc_output_directory}" | sed -e "s|%line%|${__cc_line}|g"`
+   __cc_new_command=`_replace_placeholder_shell_fragment "${__cc_command}" "%line%" "${__cc_line}"`
+   __cc_new_output_directory=`_replace_placeholder_plain_text "${__cc_output_directory}" "%line%" "${__cc_line}"`

    __cc_new_output_directory=`_sanitize_output_directory "${__cc_new_output_directory}"`

Source: GitHub Commit 2cc367d

Detection Methods for CVE-2026-41450

Indicators of Compromise

Files or directory entries on triaged systems whose names contain backticks, $(...) sequences, or embedded semicolons and shell operators.
Unexpected child processes spawned by bash, sh, or uac during a collection run, especially processes reaching out to the network or writing to /tmp.
UAC log entries showing eval execution of malformed command strings referencing %line% substitution artifacts.

Detection Strategies

Audit UAC version in use across incident response toolkits and identify hosts running versions prior to 3.3.0.
Inspect artifact collection output for filenames containing shell metacharacters before executing follow-up analysis scripts.
Review process execution telemetry on responder workstations for anomalous shell activity coincident with UAC runs.

Monitoring Recommendations

Enable shell command auditing (auditdexecve rules) on forensic workstations to capture the full argument list of processes spawned during collection.
Monitor outbound network connections from analyst hosts that occur during triage sessions.
Retain UAC execution logs and correlate them with endpoint detection telemetry to identify unexpected sub-shells.

How to Mitigate CVE-2026-41450

Immediate Actions Required

Upgrade UAC to version 3.3.0 or later on all forensic workstations and collection appliances.
Remove or quarantine legacy UAC binaries and profile bundles that predate the fix.
Run UAC only inside isolated collection environments such as disposable virtual machines or containers with no credentials to production systems.

Patch Information

The fix is delivered in GitHub Pull Request #443 and merged in commit 2cc367d. The patch replaces the unsafe sed-based substitution with two dedicated helper functions, _replace_placeholder_shell_fragment and _replace_placeholder_plain_text, which safely handle placeholder replacement without invoking eval on attacker-controlled data. Additional details are available in the VulnCheck Command Injection Advisory.

Workarounds

Execute UAC inside an ephemeral, network-restricted sandbox such as a throwaway VM or container.
Review artifact profiles and avoid foreach directives that operate on untrusted filename output until the tool is upgraded.
Pre-screen target file systems for filenames containing shell metacharacters before running collection.