Unescaped user data from /etc/passwd is injected into command strings inside parse_artifact.sh, enabling attackers to embed shell metacharacters and execute arbitrary code. This command injection (CWE‑78) allows unauthorized code execution on the analyst’s host with the privileges of the running process, potentially compromising confidentiality, integrity, and availability.

The Unix-like Artifacts Collector (UAC) from tclahr, any release earlier than 3.3.0, is vulnerable. Users of these versions should verify their installation date and version number against this requirement.

The CVSS score of 8.5 indicates a high severity, and the EPSS score is not available, implying little publicly known exploitation data. The vulnerability is not listed in CISA KEV. The likely attack vector is an attacker who can modify or create entries in /etc/passwd, e.g., a compromised or privileged account. Under those conditions, the attacker can craft a username or home directory containing shell metacharacters, which are then injected into eval‑built command strings, enabling arbitrary code execution on the analyst’s host.