CVE-2026-45322 Overview
CVE-2026-45322 is an OS command injection vulnerability [CWE-78] in Microsoft UFO, an open-source framework for intelligent automation across devices and platforms. The flaw affects tagged releases up to and including v3.0.0. The vulnerable code path resides in ShellReceiver.run_shell(), which forwards untrusted command strings to subprocess.Popen() with shell=True and executable=powershell.exe. An attacker who can write or modify a session or action JSON file can plant a shell action that executes when UFO resumes or replays the session.
Critical Impact
A local attacker with write access to UFO session JSON files can execute arbitrary PowerShell commands as the UFO process user, leading to full compromise of confidentiality, integrity, and availability on the host.
Affected Products
- Microsoft UFO framework, tagged releases up to and including v3.0.0
- Deployments using ShellReceiver.run_shell() or ShellReceiver.execute_command()
- Workflows invoking RunShellCommand.execute() or ExecuteCommand.execute() action classes
Discovery Timeline
- 2026-05-27 - CVE-2026-45322 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45322
Vulnerability Analysis
Microsoft UFO records planned and executed actions in per-session JSON files. The framework can later resume or replay these sessions, re-issuing each stored action. Shell actions are dispatched through action classes such as RunShellCommand.execute() and ExecuteCommand.execute(), which forward stored parameters to a shell receiver. The receiver invokes subprocess.Popen() with shell=True and executable=powershell.exe, allowing PowerShell to interpret the supplied command string. The same execution path is reachable from ShellReceiver.execute_command().
Because the command string originates from action parameters that are persisted to disk, any tampering with the JSON record translates directly into arbitrary command execution. The exploitation impact is constrained only by the privileges of the UFO process user.
Root Cause
The root cause is unsafe construction of a shell command from attacker-controllable data. UFO trusts the content of per-session JSON records and passes the embedded string to subprocess.Popen() with shell=True. No argument tokenization, allowlisting, or input validation is applied before invoking PowerShell.
Attack Vector
Exploitation requires local write access to a UFO session or action JSON file. The attacker modifies a stored shell action so its parameters contain malicious PowerShell syntax. When the victim or an automation workflow resumes or replays the session, UFO loads the tampered record and executes the planted command. The attack does not require user interaction beyond triggering the normal replay or resume flow.
No verified public proof-of-concept is available. The vulnerability mechanism is described in the GitHub Security Advisory.
Detection Methods for CVE-2026-45322
Indicators of Compromise
- Unexpected powershell.exe child processes spawned by the Python interpreter hosting UFO
- Modifications to UFO per-session JSON files by users or processes outside the normal automation workflow
- Shell action parameters containing PowerShell metacharacters such as ;, |, &, backticks, or Invoke-Expression
Detection Strategies
- Monitor process trees for python.exe parents launching powershell.exe with command-line strings sourced from UFO action data
- Apply file integrity monitoring to UFO session and action JSON directories to flag out-of-band edits
- Hunt for PowerShell command lines that contain encoded payloads, download cradles, or outbound network calls originating from UFO sessions
Monitoring Recommendations
- Centralize endpoint process telemetry and PowerShell script block logs in a SIEM for correlation with UFO session activity
- Alert on writes to UFO session JSON files by accounts not associated with the UFO service identity
- Track changes to ShellReceiver, RunShellCommand, and ExecuteCommand modules on hosts running UFO
How to Mitigate CVE-2026-45322
Immediate Actions Required
- Restrict filesystem permissions on UFO session and action JSON directories to the UFO service account only
- Run UFO under a least-privilege user account that lacks administrative rights on the host
- Disable session resume and replay features in untrusted or shared environments until a patched release is deployed
- Audit existing session JSON files for unexpected shell actions before resuming any session
Patch Information
Refer to the GitHub Security Advisory GHSA-wj72-7w8h-695f for the authoritative list of fixed versions and remediation guidance. Upgrade beyond v3.0.0 to a release that addresses the shell injection in ShellReceiver.run_shell() and ShellReceiver.execute_command().
Workarounds
- Store UFO session JSON files on a filesystem location with strict ACLs that block write access by non-service accounts
- Avoid invoking RunShellCommand and ExecuteCommand action classes in workflows that process untrusted input
- Wrap shell receivers with an allowlist of permitted commands and reject parameters containing shell metacharacters
- Execute UFO inside a sandbox or container with constrained capabilities to limit the blast radius of a successful injection
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
