CVE-2026-76055
Received Received - Intake

Improper OS Command Injection in Black Duck blackduck-c-cpp

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: Synopsys

Description
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76055
EUVD
EUVD-2026-64896

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
synopsys blackduck_c_cpp to 3.0.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of special characters in file paths by the Black Duck blackduck-c-cpp package manager before version 3.0.7. When scanning a build directory, the tool executes OS commands using shell interpolation without proper escaping or quoting. This allows an attacker who can create files in the scanned directory to inject and execute arbitrary operating system commands with the privileges of the account running the scan.

Detection Guidance

This vulnerability involves improper handling of filesystem paths in Black Duck blackduck-c-cpp before 3.0.7. Detection requires checking the installed version of the package manager component. Use commands like 'blackduck-c-cpp --version' or inspect package metadata to verify if the version is below 3.0.7.

Impact Analysis

An attacker could exploit this to run malicious commands on your system, potentially leading to unauthorized access, data theft, or system compromise. Since no special permissions or control over the build process are required, any user able to place files in the scanned directory could trigger this issue.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. Such incidents may violate compliance requirements under GDPR (data protection), HIPAA (health data security), or other regulations, leading to legal penalties, reputational damage, and mandatory breach notifications.

Mitigation Strategies

Upgrade Black Duck blackduck-c-cpp to version 3.0.7 or later immediately. Avoid running scans in directories where untrusted files may exist. Ensure the account running scans has minimal privileges to reduce potential impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart