Microsoft UFO’s ShellReceiver.run_shell method passes an untrusted command string directly to subprocess.Popen with shell=True and powershell.exe, without sanitization. This flaw allows an attacker to execute arbitrary operating‑system commands when UFO processes a replayed action. The vulnerability can be leveraged to run any command with the permissions of the UFO process user, resulting in full compromise of the host system.

The affected product is Microsoft UFO, versions up to and including 3.0.0. Any deployment running these releases is vulnerable until a patch is applied.

The CVSS score of 7.8 indicates high severity, but the EPSS score is not available, so the current exploitation probability is unknown. It is not listed in the CISA KEV catalog, implying no known public exploitation at this time. The attack path requires an attacker who can write or modify a session or action JSON file; thus local compromise or the ability to tamper with session files is needed. Once a malicious action is planted, UFO’s replay logic will execute it as the UFO process user, effectively giving the attacker local command execution.