---
id: CVE-2026-76055
title: >-
  Improper Neutralization of Special Elements used in an OS Command in the
  package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an
  actor able to create a file within the scanned build directory to execute
  operating s…
summary: >-
  Improper Neutralization of Special Elements used in an OS Command in the
  package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an
  actor able to create a file within the scanned build directory to execute
  operating s…
severity: none
cwe:
  - CWE-78
published: '2026-08-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76055'
references:
  - url: >-
      https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2026-76054-CVE-2026-76055
    label: disclosure@synopsys.com
  - url: 'https://pypi.org/project/blackduck-c-cpp/'
    label: disclosure@synopsys.com
tags:
  - nvd
epss: 0.00186
epssPercentile: 0.07566
ingestedAt: '2026-10-12T15:55:08.121Z'
---

## Overview

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan.



Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.