Vulnerability · Published Apr 8, 2026 · Assigned by VulnCheck

CVE-2026-40032UAC < 3.3.0-rc1 Command Injection via Placeholder Substitution

High 7.8

In plain English

A high-severity OS command injection in UAC from tclahr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.7%top 45.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the _run_command() function passes constructed command strings directly to eval without proper sanitization. Attackers can inject shell metacharacters or command substitutions through attacker-controlled inputs including %line% values from foreach iterators and %user% / %user_home% values derived from system files to achieve arbitrary command execution with the privileges of the UAC process.

Affected products (as reported)

Vendor	Product	Versions
tclahr	UAC	0 – before 3.3.0-rc1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Pull Request issue-tracking
Patch Commit #1 patch
Patch Commit #2 patch
Patch Commit #3 patch
Related Issue issue-tracking
Mobasi Sentinel Vulnerability Index vendor-advisory
VulnCheck Advisory: UAC < 3.3.0-rc1 Command Injection via Placeholder Substitution third-party-advisory