CVE-2026-41451 is an OS command injection vulnerability in tclahr's UAC product affecting versions before 3.3.0. The flaw exists in the user substitution logic within parse_artifact.sh, where unescaped usernames and home directory paths from /etc/passwd are inserted directly into command strings executed via eval. This improper neutralization of special elements enables attackers to inject shell metacharacters such as command substitution syntax or semicolons, leading to arbitrary command execution on the analyst's host system. The vulnerability is rated high severity with a CVSS 4.0 score of 8.5, reflecting local attack vector with low complexity, no privileges required, but user interaction needed. No known exploits in the wild or vendor patches have been reported as of the published date.

Successful exploitation allows an attacker to execute arbitrary commands on the affected system with the privileges of the user running the UAC tool. This can lead to unauthorized system access, data compromise, or further system manipulation. The attack requires local access and user interaction but no elevated privileges. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running UAC versions prior to 3.3.0 in untrusted environments or with untrusted /etc/passwd entries. Consider manual code review or modification to sanitize inputs before eval execution as a temporary mitigation.