UAC (Unix-like Artifacts Collector) that processes log or system files builds command strings by interpolating placeholder values and then passes them to eval without sanitization. This flaw, identified as CWE‑78, permits a malicious actor to inject shell metacharacters or command substitutions through attacker‑controlled inputs such as %line% values from foreach iterators and system‑derived %user% or %user_home% placeholders. The result is arbitrary command execution with the privileges of the UAC process.

Affected are installations of UAC by tclahr before version 3.3.0‑rc1. The vulnerability resides in the placeholder substitution logic of the _run_command function and is present in all releases up to, but not including, 3.3.0‑rc1. No other versions are known to be impacted.

The CVSS score is 8.5, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through manipulation of input data that UAC consumes; based on the description, it is inferred that an attacker who can supply crafted values to the placeholder substitution (for example by creating or modifying log entries that UAC processes) can trigger the eval path and execute arbitrary commands. This attack does not require complex prerequisites beyond controlling the input data, making it relatively straightforward for an attacker with access to the affected system.