CVE-2026-40032 is a command injection vulnerability in the UAC (Unix-like Artifacts Collector) software before version 3.3.0-rc1. The vulnerability arises because the _run_command() function directly passes constructed command strings to eval without proper sanitization of special shell characters. Attacker-controlled inputs, including %line% values from foreach iterators and %user% or %user_home% values derived from system files, can be manipulated to inject arbitrary shell commands. Successful exploitation results in arbitrary command execution with the privileges of the UAC process. The CVSS 4.0 vector indicates local attack vector with low attack complexity, no privileges required, user interaction required, and high impacts on confidentiality, integrity, and availability.

An attacker able to supply crafted inputs to UAC can execute arbitrary OS commands with the privileges of the UAC process. This can lead to full compromise of the affected system depending on the privileges of UAC. The vulnerability affects confidentiality, integrity, and availability of the system. There are no known public exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running untrusted inputs through UAC or restrict usage to trusted environments. Monitor vendor channels for updates regarding patches or official mitigations.