CyberRota Analysis
AI-GeneratedVersions of UAC prior to 3.3.0 are vulnerable to a command injection flaw in the _command_collector function, allowing attackers to execute arbitrary commands on the host system by leveraging malicious filenames or artifact definitions with shell metacharacters. This high-severity vulnerability (CVSS 7.8) poses significant risks to systems using affected versions, particularly for organizations that rely on UAC for artifact collection and analysis. Security teams should prioritize patching or upgrading to version 3.3.0 or later to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons to execute arbitrary commands on the analyst's host system.