PT-2026-31469 · Tclahr · Uac

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-40032

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the run command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40032

Affected Products

Uac

References · 8

• https://github.com/tclahr/uac/commit/50ace60e172e38feb78347bdf579311c23eff078 · Patch
• https://github.com/tclahr/uac/commit/d0fca5e36d8d6a33a4404f0f6fe92b0424544589 · Patch
• https://github.com/tclahr/uac/commit/cb95d7166cd47908e1189d9669e43f9a6d3d707f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40032 · Security Note
• https://mobasi.ai/sentinel · Vendor Advisory
• https://github.com/tclahr/uac/pull/443 · Note
• https://github.com/tclahr/uac/issues/429 · Note
• https://vulncheck.com/advisories/uac-rc1-command-injection-via-placeholder-substitution · Note