CVE-2026-41451: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in tclahr uac

The vulnerability arises from improper neutralization of special elements in OS commands within the user substitution logic of parse_artifact.sh in UAC versions before 3.3.0. Specifically, usernames and home directories extracted from /etc/passwd are inserted into command strings without escaping, and these commands are executed using eval. An attacker who can influence /etc/passwd entries can inject shell metacharacters such as command substitution syntax or semicolons, enabling execution of arbitrary commands on the host system running the UAC tool.

Successful exploitation allows an attacker to execute arbitrary commands on the analyst's host system with the privileges of the user running UAC. This can lead to system compromise, data exposure, or further attacks. The vulnerability requires the attacker to control or influence /etc/passwd entries, which may limit the attack vector depending on system configuration.

A fix is available in UAC version 3.3.0 and later. Users should upgrade to version 3.3.0 or newer to remediate this vulnerability. Until then, avoid running UAC on systems where /etc/passwd entries may be untrusted or manipulated. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.