Threat Intelligence Database

CVE-2026-76055 is a high-severity OS command injection vulnerability in Black Duck's blackduck-c-cpp package manager component prior to version 3.0.7. It allows an attacker who can create a file in the scanned build directory to execute arbitrary OS commands as the user running the scan. This occurs because filesystem paths are interpolated into shell command strings without proper quoting or escaping, enabling shell metacharacters to be interpreted. No control over the build command or tool configuration is needed for exploitation.

CVE-2026-76054 is a vulnerability in Black Duck blackduck-c-cpp versions 1.0.17 through 3.0.6 that allows an actor with code execution capability within the scanned project's build to access the Black Duck API token. This occurs because the token, when supplied via the BLACKDUCK_API_TOKEN or BD_HUB_TOKEN environment variables, is exposed through the ambient process environment inherited by subprocesses during build capture and signature scanning. Upgrading to version 3.0.7 or later addresses the vulnerability, but prior token exposure requires token rotation.