CVE-2026-40032
Received Received - Intake
Command Injection in UAC Before 3.3.0-rc1 Enables Arbitrary Execution

Publication date: 2026-04-08

Last updated on: 2026-04-08

Assigner: VulnCheck

Description
UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user_home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-08
Last Modified
2026-04-08
Generated
2026-06-16
AI Q&A
2026-04-09
EPSS Evaluated
2026-06-15
NVD
CVE-2026-40032
EUVD
EUVD-2026-20775
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tclahr uac to 3.3.0-rc1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in UAC (Unix-like Artifacts Collector) versions before 3.3.0-rc1. It is a command injection flaw in the placeholder substitution and command execution pipeline. Specifically, the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can exploit this by injecting shell metacharacters or command substitutions through inputs they control, such as %line% values from foreach iterators and %user% or %user_home% values derived from system files. This allows arbitrary command execution with the privileges of the UAC process.

Impact Analysis

The vulnerability allows attackers to execute arbitrary commands on the affected system with the privileges of the UAC process. This can lead to unauthorized access, data manipulation, system compromise, and potentially full control over the affected system depending on the privileges of the UAC process.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart