Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-105791Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection

High 7.5

In plain English

A high-severity argument injection in UFO from microsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 45.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the bash_command parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attacker-influenced agent call can launch an arbitrary executable or script as the desktop user even though the subprocess uses shell=False. Exploitation depends on a user running an affected agent workflow and on inducing the tool call, but successful execution can access or modify that user's files, tokens, and sessions. This issue is fixed in version 3.0.9.

Affected products (as reported)

Vendor	Product	Versions
microsoft	UFO	< 3.0.9

Weakness: CWE-88, CWE-184 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/microsoft/UFO/security/advisories/GHSA-cmq9-vqjf-4q2q x_refsource_CONFIRM
https://github.com/microsoft/UFO/commit/3e1262fc091eb319253b7a1338b63f62cc6c82b1 x_refsource_MISC
https://github.com/microsoft/UFO/releases/tag/v3.0.9 x_refsource_MISC