CVE-2026-76055: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Black Duck blackduck-c-cpp

The vulnerability arises from improper neutralization of special elements used in OS commands within blackduck-c-cpp before version 3.0.7. Specifically, when scanning directories, filesystem paths are inserted into shell commands without escaping, allowing an attacker with the ability to place files in the scanned directory to inject and execute arbitrary commands as the scanning user. This flaw is identified as CWE-78 (OS Command Injection) and has a CVSS 4.0 score of 7.5, reflecting high severity. There is no vendor advisory indicating a patch or remediation level, and no known exploits in the wild have been reported.

An attacker able to create files in the scanned build directory can execute arbitrary operating system commands with the privileges of the user running the scan. This could lead to unauthorized command execution and potential compromise of the scanning environment. The vulnerability does not require control over the build command or tool configuration, increasing the risk if an attacker can write to the scanned directory.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions to scanned build directories to trusted users only to prevent unauthorized file creation. Monitor for updates from Black Duck regarding patches or official mitigations.