CVE-2026-41450 is an OS command injection flaw in UAC (Unix-like Artifacts Collector) before version 3.3.0. The record scores it 7.8 (High), while VulnCheck's advisory scores it 8.5. Crafted filenames or artifact definitions can run commands on the analyst's host. The fix is UAC 3.3.0 or later.
What's affected
The record and the VulnCheck advisory both say UAC versions before 3.3.0 are affected, with the fix in 3.3.0. The patch is in the project's pull request 443 and commit 2cc367d. The record lists no product entries, so this is a standalone open source tool rather than a package in a vendor catalogue.
Source conflict to note: the record scores this 7.8 (High) with CVSS 3.1. VulnCheck scores it 8.5 (High) with CVSS 4.0. Both rate it High.
Weakness class: CWE-78, OS command injection.
How to check if you're exposed
Run UAC with its version option or check the version file in the folder where you keep it, and compare with 3.3.0. If your team vendors UAC inside an incident response toolkit, a USB drive image or a container, check those copies too, since they are the ones most likely to be out of date.
Also check what you run UAC against. The risk is on the analyst's side: the tool reads output and names from the system being examined, and if that system is hostile, the data can contain shell metacharacters.
What to do now
- Upgrade UAC to 3.3.0 or later from the project's GitHub repository, and replace old copies in toolkits and images.
- Until you upgrade, avoid running UAC against untrusted file paths or artifact definitions. This is our general advice and the advisory does not list a workaround.
- Run collection tools from a disposable or isolated analyst environment, not from your main workstation.
- Treat output from compromised hosts as hostile when you process it, including filenames.
- Review any custom artifact definition files your team wrote for similar substitution patterns.
Why it matters
The bug is a classic injection. According to the advisory, in the function that handles commands that loop over output lines, each line is substituted into a command string without escaping and then evaluated by the shell. If a line comes from a filename an attacker chose, shell syntax in that name is run as a command.
What makes it interesting is who it hurts. Forensic tools run against machines that may already be compromised, and the attacker may have prepared the machine for the day someone investigates it. A flaw like this turns evidence collection into a way to attack the responder. The KEV flag is false and the advisory does not report exploitation, but the scenario is plausible enough to justify a quick update.
Try it yourself
Open source tools in your response kit belong in your inventory too. This demo shows how an inventory finds them.
Click through it at your own pace, or open it full screen.
Quick check
Who is at risk?
The analyst running UAC. The commands run on the host where UAC runs, not on the examined system alone.
Is there a workaround?
The advisory lists none. Upgrading to 3.3.0 is the fix.
Sources
Last reviewed: 18 October 2026.
