Vulnerability · Published Aug 24, 2026 · Assigned by BlackDuck

CVE-2026-76055

High 7.5

In plain English

A high-severity OS command injection in blackduck-c-cpp from Black Duck. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.2%top 91.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.

Affected products (as reported)

Vendor	Product	Versions
Black Duck	blackduck-c-cpp	0 – before 3.0.7

Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

Black Duck Product Security Advisory vendor-advisory
blackduck-c-cpp on PyPI product