CVE-2026-41449 is an OS command injection vulnerability in the _run_command function of UAC (Unix-like Artifacts Collector) versions before 3.3.0. The vulnerability arises from improper neutralization of special shell metacharacters in untrusted data fields like usernames, process names, or filenames. Attackers can exploit this by supplying crafted evidence inputs or maliciously named mounted images or artifact definitions, resulting in arbitrary command execution on the host system running UAC during evidence processing.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the analyst's host with the privileges of the UAC process. This can lead to remote code execution, potentially compromising the host system. The CVSS 4.0 score of 8.5 reflects high impact with local attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or suspicious evidence inputs, mounted images, or artifact definitions that could contain malicious shell metacharacters. Monitor vendor channels for updates and apply patches promptly once released.