CVE-2026-41451: UAC Command Injection RCE Vulnerability

CVE-2026-41451 Overview

CVE-2026-41451 is a command injection vulnerability in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0. The flaw resides in the user substitution logic within parse_artifact.sh, where usernames and home directory paths from /etc/passwd are inserted directly into command strings and executed through eval without proper escaping. An attacker who controls entries in /etc/passwd on a target system can inject shell metacharacters that execute on the analyst's host when UAC parses collected artifacts. The vulnerability is tracked under CWE-78 (OS Command Injection).

Critical Impact
Arbitrary command execution on the forensic analyst's workstation when processing artifacts collected from a compromised or attacker-controlled Unix-like system.

Affected Products

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0
Forensic collection workflows relying on parse_artifact.sh user substitution
Analyst systems that parse UAC output from untrusted hosts

Discovery Timeline

2026-08-21 - CVE-2026-41451 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-41451

Vulnerability Analysis

UAC is an open-source triage collection tool used by incident responders to gather live-response artifacts from Unix-like systems. During artifact parsing, UAC iterates over user account entries and substitutes placeholder tokens such as %line% with values read from /etc/passwd. Prior to version 3.3.0, that substitution occurred inside strings that were later evaluated by eval, meaning shell metacharacters embedded in a username or home directory were interpreted as code rather than data.

The attack targets the analyst rather than the collection endpoint. When an examiner runs UAC against a filesystem image or live host controlled by an adversary, a booby-trapped /etc/passwd entry can hijack execution on the analyst's workstation. This inverts the normal trust boundary of forensic tooling.

Root Cause

The root cause is unsanitized string interpolation into shell commands. In lib/command_collector.sh, values were substituted using sed and then passed through backticks and eval, so command substitution syntax (`...` or $(...)) and separators such as ; remained active. The upstream fix introduces two dedicated helpers, _replace_placeholder_shell_fragment and _replace_placeholder_plain_text, that produce properly escaped fragments before evaluation.

Attack Vector

Exploitation requires the analyst to run UAC (user interaction) against a host or image where the attacker has controlled /etc/passwd contents. Attack complexity is low and no privileges are required on the analyst system beyond what UAC itself uses. A malicious username such as foo`id > /tmp/pwn` or a crafted home directory containing ; characters is sufficient to trigger execution.

bash

# Excerpt from the upstream fix in lib/command_collector.sh
       | while IFS= read __cc_line && [ -n "${__cc_line}" ]; do
 
           # replace %line% by __cc_line value
-          __cc_new_command=`echo "${__cc_command}" | sed -e "s|%line%|${__cc_line}|g"`
-          __cc_new_output_directory=`echo "${__cc_output_directory}" | sed -e "s|%line%|${__cc_line}|g"`
+          __cc_new_command=`_replace_placeholder_shell_fragment "${__cc_command}" "%line%" "${__cc_line}"`
+          __cc_new_output_directory=`_replace_placeholder_plain_text "${__cc_output_directory}" "%line%" "${__cc_line}"`
           
           __cc_new_output_directory=`_sanitize_output_directory "${__cc_new_output_directory}"`

Source: GitHub commit 2cc367d

Detection Methods for CVE-2026-41451

Indicators of Compromise

Unexpected child processes spawned by uac or sh under the analyst's user context during artifact collection or parsing
/etc/passwd entries containing shell metacharacters such as `, $(, ;, or && in the username or home directory fields
Outbound network connections originating from the forensic workstation shortly after launching UAC against a target image

Detection Strategies

Review UAC version strings in deployment scripts and analyst toolkits; any version below 3.3.0 is affected
Statically scan collected /etc/passwd files for non-POSIX characters in user or home directory fields before parsing
Correlate UAC execution timestamps with process creation events on the analyst host to identify unauthorized child processes

Monitoring Recommendations

Run UAC inside an isolated virtual machine or container with no credentials, tokens, or network access to production systems
Enable shell auditing (auditd, execve tracing) on analyst workstations to capture command lines invoked during triage
Alert on any process launched by UAC that is not part of its documented artifact-parsing toolchain

How to Mitigate CVE-2026-41451

Immediate Actions Required

Upgrade UAC to version 3.3.0 or later on all forensic workstations and response toolkits
Treat any UAC output collected with prior versions from untrusted hosts as potentially malicious input
Rebuild analyst workstations that processed suspicious images with vulnerable UAC releases

Patch Information

The vulnerability is fixed in UAC 3.3.0 via pull request #443, which introduces _replace_placeholder_shell_fragment and _replace_placeholder_plain_text helpers so that values from /etc/passwd are escaped before entering command strings. Full details are available in the VulnCheck advisory.

Workarounds

Execute UAC only within ephemeral sandboxes such as disposable VMs or containers that are destroyed after each engagement
Manually inspect and sanitize /etc/passwd in mounted target filesystems before running UAC parsing routines
Restrict outbound network access from analyst systems used for triage of untrusted evidence