Microsoft UFO, an open-source framework for intelligent automation, has an OS command injection vulnerability (CWE-78) in tagged releases up to and including version 3.0.0. The issue occurs in the shell action replay path where ShellReceiver.run_shell() and ShellReceiver.execute_command() invoke subprocess.Popen() with shell=True and PowerShell as the executable, passing unsanitized command strings from action parameters. Because UFO stores planned and executed actions in per-session JSON files, an attacker able to write or modify these JSON files can plant shell commands that execute upon session replay, running with the privileges of the UFO process user. This vulnerability is exploitable locally with low privileges and does not require user interaction.

Successful exploitation allows an attacker with write access to session or action JSON files to execute arbitrary commands on the host system with the permissions of the UFO process user. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to session and action JSON files to trusted users only to prevent unauthorized modification. Monitor for suspicious modifications to these files and avoid resuming or replaying sessions from untrusted sources.