Description

UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user_home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.

INFO

Published Date :

2026-04-08T21:35:27.020Z

Last Modified :

2026-04-09T19:32:44.357Z

Source :

VulnCheck
AFFECTED PRODUCTS

The following products are affected by CVE-2026-40032 vulnerability.

Vendors Products
Tclahr
  • Uac
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40032.

URL Resource
https://github.com/tclahr/uac/commit/50ace60e172e38feb78347bdf579311c23eff078 cve-icon cve-icon
https://github.com/tclahr/uac/commit/cb95d7166cd47908e1189d9669e43f9a6d3d707f cve-icon cve-icon
https://github.com/tclahr/uac/commit/d0fca5e36d8d6a33a4404f0f6fe92b0424544589 cve-icon cve-icon
https://github.com/tclahr/uac/issues/429 cve-icon cve-icon
https://github.com/tclahr/uac/pull/443 cve-icon cve-icon
https://mobasi.ai/sentinel cve-icon cve-icon
https://www.vulncheck.com/advisories/uac-rc1-command-injection-via-placeholder-substitution cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact