CVE-2026-40032

216.73.217.64

· Published 08/04/2026 22:16 · Modified 08/04/2026 22:16

Labels: CVE-2026-40032 2026-04-08 CVE-2026-40032 CWE-78 [email protected]

Essential information

Published: 08/04/2026 22:16
Modified: 08/04/2026 22:16
Author: —
Creator: —
CVSS: 8.5 HIGH (v3) 8.5 HIGH (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user_home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
uac / uac	`cpe:2.3:a:uac:uac:<3.3.0-rc1:::::::*`