CVE-2026-105791

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the bash_command parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attacker-influenced agent call can launch an arbitrary executable or script as the desktop user even though the subprocess uses shell=False. Exploitation depends on a user running an affected agent workflow and on inducing the tool call, but successful execution can access or modify that user's files, tokens, and sessions. This issue is fixed in version 3.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105791

EUVD

EUVD-2026-93419

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	UFO	< 3.0.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

Microsoft UFO before 3.0.9 has a flaw in the run_shell tool where it only checks the first token of the bash_command parameter. This allows explorer.exe to be used, which on Windows can delegate path arguments to ShellExecute. An attacker can exploit this to run arbitrary executables or scripts as the desktop user, even though the subprocess uses shell=False.

Detection Guidance

Check the installed version of Microsoft UFO. If it is below 3.0.9, the system is vulnerable. Run: pip show microsoft-ufo or check the version in your project files.

Impact Analysis

If you run an affected agent workflow and an attacker tricks you into making a tool call, they could execute malicious code on your system. This could let them access or modify your files, steal tokens, or hijack your user session.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of user files, tokens, and sessions, which may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., unauthorized access to protected health information).

Mitigation Strategies

Upgrade Microsoft UFO to version 3.0.9 or later immediately. Remove or restrict access to the run_shell tool in affected workflows until patched.

Hi! I’m here to help you understand CVE-2026-105791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70