---
id: CVE-2026-41449
title: >-
  UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command
  injection vulnerability in the _run_command function that allows attackers to
  execute arbitrary commands by injecting shell metacharacters into untrusted
  data …
summary: >-
  UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command
  injection vulnerability in the _run_command function that allows attackers to
  execute arbitrary commands by injecting shell metacharacters into untrusted
  data …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-08-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41449'
references:
  - url: >-
      https://github.com/tclahr/uac/commit/2cc367d8ead388f05abd3cfb8af537788a124e72
    label: disclosure@vulncheck.com
  - url: 'https://github.com/tclahr/uac/pull/443'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/uac-command-injection-via-run-command-sh
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.01033
epssPercentile: 0.62233
ingestedAt: '2026-09-24T20:51:40.216Z'
---

## Overview

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or tampered artifact definitions to achieve remote code execution on the analyst's host when processing evidence.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.