CVE-2026-41450 is a command injection vulnerability affecting tclahr's UAC product in versions before 3.3.0. The vulnerability arises in the _command_collector function where foreach command output lines are substituted directly into command strings using sed without proper escaping. These strings are then evaluated with eval, allowing an attacker to inject arbitrary shell commands by including shell metacharacters such as command substitution syntax or semicolons in filenames or artifact definitions. This can lead to arbitrary code execution on the analyst's host system.

Successful exploitation allows an attacker to execute arbitrary commands on the host system running UAC, potentially leading to full system compromise or unauthorized actions performed with the privileges of the user running the software. The CVSS 4.0 score of 8.5 indicates a high severity with local attack vector, low attack complexity, no privileges required, but requiring user interaction. The vulnerability has high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted filenames or artifact definitions with UAC versions prior to 3.3.0. Consider running UAC in a restricted environment or with least privilege to limit potential impact.