The vulnerability is a command injection flaw in the UAC (Unix-like Artifacts Collector) tool. In versions before 3.3.0, the helper function that collects artifact commands does not properly escape user‑supplied text. Lines of output from an artifact are substituted into dynamic shell commands via sed and then fed directly to eval. This allows an attacker to inject arbitrary shell metacharacters, including command substitution or semicolons, into filenames or artifact definitions, causing the analyst’s host to run malicious code. The weakness is classified as CWE‑78, which indicates a failure to properly sanitize input used in system command execution.

Affected are deployments of tclahr’s UAC before version 3.3.0. The vulnerability can be triggered by any artifact record or filename that contains shell metacharacters, so any installation using user‑supplied artifact definitions or directory listings is potentially impacted.

The CVSS score of 8.5 reflects a high‑severity, local‑impact risk. Because the exploit requires the ability to create or modify artifact definitions or file names, the attack vector is likely local or by a privileged user with write access to the artifact store. EPSS data is not available, so the likelihood of widespread exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the combination of a high CVSS score and the ease of injection makes this flaw a significant risk for environments where UAC runs with elevated privileges.