The vulnerability resides in the run_shell tool of Microsoft UFO’s CommandLineExecutor component, where only the first token of the bash_command parameter is validated. On Windows the Explorer.exe command accepts a path argument that is forwarded to ShellExecute, enabling an attacker to induce an agent workflow that launches an arbitrary executable or script under the current desktop user’s identity, despite subprocesses using shell=False. Successful exploitation allows the attacker to access or modify the user’s files, tokens, and sessions, effectively achieving remote code execution within that user’s context.

Microsoft UFO open‑source framework, versions earlier than 3.0.9. The vulnerability exists in the ufo/client/mcp/local_servers/cli_mcp_server.py file where the run_shell functionality is defined. Version 3.0.9 and newer contain the fix.

The CVSS score of 7.5 indicates a high severity vulnerability that could be leveraged locally by an attacker who can trigger an affected agent workflow. No EPSS score is available; the vulnerability is not listed in the CISA KEV catalog. Attackers would need to influence the agent’s input to include explorer.exe as the first token and supply a malicious path argument. If achieved, the attacker operates with the same privileges as the desktop user, potentially compromising sensitive data and local system integrity.