CVE-2026-41451

Name of the Vulnerable Software and Affected Versions UAC (Unix-like Artifacts Collector) versions prior to 3.3.0

Description A command injection issue exists in the user substitution logic within the parse artifact.sh script. The software substitutes usernames and home directories from /etc/passwd directly into command strings without proper escaping before they are executed via the eval function. This allows an attacker to execute arbitrary commands on the analyst's host system by using crafted usernames or home directory paths containing shell metacharacters, such as semicolons or command substitution syntax.

Recommendations Update UAC (Unix-like Artifacts Collector) to version 3.3.0 or later.