CVE-2026-76055: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Black Duck blackduck-c-cpp
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.
AI Analysis
Technical Summary
The vulnerability in Black Duck blackduck-c-cpp prior to version 3.0.7 arises from improper neutralization of special elements in OS commands (CWE-78). Specifically, when traversing the scanned build directory, filesystem paths are embedded directly into shell commands without escaping or quoting. An attacker able to place a file with crafted pathnames containing shell metacharacters can cause arbitrary command execution as the user running the scan. This flaw requires only the ability to create files in the scanned directory and does not require control over the scanning tool's configuration or build commands.
Potential Impact
An attacker with the ability to create files in the scanned build directory can execute arbitrary operating system commands with the privileges of the scanning process. This can lead to unauthorized command execution, potentially compromising the host system or escalating privileges depending on the scanning account's rights. The vulnerability has a CVSS 4.0 score of 7.5, indicating high severity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 3.0.7 or later once a fix is available. Until then, restrict the ability to create files in scanned build directories to trusted users only to reduce risk.
CVE-2026-76055: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Black Duck blackduck-c-cpp
Description
Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.
CVSS v4.0
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Black Duck blackduck-c-cpp prior to version 3.0.7 arises from improper neutralization of special elements in OS commands (CWE-78). Specifically, when traversing the scanned build directory, filesystem paths are embedded directly into shell commands without escaping or quoting. An attacker able to place a file with crafted pathnames containing shell metacharacters can cause arbitrary command execution as the user running the scan. This flaw requires only the ability to create files in the scanned directory and does not require control over the scanning tool's configuration or build commands.
Potential Impact
An attacker with the ability to create files in the scanned build directory can execute arbitrary operating system commands with the privileges of the scanning process. This can lead to unauthorized command execution, potentially compromising the host system or escalating privileges depending on the scanning account's rights. The vulnerability has a CVSS 4.0 score of 7.5, indicating high severity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 3.0.7 or later once a fix is available. Until then, restrict the ability to create files in scanned build directories to trusted users only to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- BlackDuck
- Date Reserved
- 2026-08-18T20:17:16.395Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8c53b1acd9273b49a6bf09
Added to database: 08/24/2026, 14:22:41 UTC
Last enriched: 08/24/2026, 14:37:05 UTC
Last updated: 08/24/2026, 15:33:19 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.