---
id: CVE-2026-41450
title: >-
  UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command
  injection vulnerability in the _command_collector function where foreach
  command output lines are substituted directly into command strings via sed
  without pro…
summary: >-
  UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command
  injection vulnerability in the _command_collector function where foreach
  command output lines are substituted directly into command strings via sed
  without pro…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-08-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41450'
references:
  - url: >-
      https://github.com/tclahr/uac/commit/2cc367d8ead388f05abd3cfb8af537788a124e72
    label: disclosure@vulncheck.com
  - url: 'https://github.com/tclahr/uac/pull/443'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/uac-command-injection-via-command-collector-sh
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0114
epssPercentile: 0.65192
ingestedAt: '2026-09-24T20:51:40.216Z'
---

## Overview

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons to execute arbitrary commands on the analyst's host system.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.