Description

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons to execute arbitrary commands on the analyst's host system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-21T18:16:48.257Z",
  "pubdate": "2026-08-21T18:16:48.257Z",
  "executiveSummary": "A command injection vulnerability exists in UAC (Unix-like Artifacts Collector) versions prior to 3.3.0. The vulnerability resides within the _command_collector function, where output lines from foreach commands are substituted directly into command strings using sed without adequate input sanitization or escaping, subsequently leading to evaluation via the eval builtin. This flaw permits malicious actors to achieve arbitrary command execution on the target host system utilized by the security analyst. The risk implication is severe, as successful exploitation compromises the integrity, confidentiality, and availability of the analyst's host environment. Attackers can exploit this vulnerability by crafting malicious filenames or artifact definitions containing specific shell metacharacters, such as command substitution syntax or semicolons. The capability allows an attacker to execute arbitrary system commands within the security context of the user running the collector. Remediation requires updating UAC to version 3.3.0 or later where the improper evaluation and substitution mechanisms are resolved.",
  "technicalDetails": "The vulnerability is caused by insecure input handling and direct string substitution within the shell execution context of the UAC (Unix-like Artifacts Collector) codebase. Specifically, the vulnerable component is the _command_collector function present in versions prior to 3.3.0. The root cause stems from the practice of taking output lines generated by foreach commands, processing them via sed, and substituting them directly into command strings without implementing proper escaping mechanisms. These dynamically constructed command strings are subsequently passed to the eval command for execution, transforming untrusted data into executable shell commands.\nThe attack flow requires an attacker to introduce malicious payloads via artifact definitions or crafted filenames that are processed during the collection phase. When UAC parses these malicious artifacts or filenames, the foreach command generates output containing shell metacharacters, including semicolons or command substitution syntax (such as backticks or dollar-parentheses). During the execution of the _command_collector function, the sed utility substitutes these malicious lines directly into the command string without neutralization. When the eval function evaluates the resulting string, the embedded shell metacharacters are interpreted by the underlying shell interpreter rather than being treated as literal string data.\nRegarding constraints and requirements, the vulnerability can be triggered locally or via ingestion of malicious artifacts depending on the collection vector. Authentication or privilege requirements are dependent on the context in which UAC is executed, but successful exploitation executes arbitrary commands with the privileges of the analyst running the tool. The payload behavior involves the immediate execution of attacker-supplied commands on the analyst's host system. Post-exploitation impact includes full system compromise, unauthorized data exfiltration, lateral movement within the environment, and manipulation of collected forensic artifacts to hide malicious activity or plant false evidence."
}