Microsoft UFO’s ShellReceiver.run_shell method passes untrusted command strings directly to subprocess.Popen with shell=True and powershell.exe, exposing a command‑execution flaw. The vulnerability allows an adversary who can inject a malicious action into a stored session file to run arbitrary operating‑system commands when UFO replays that session. Because the command is executed with the permissions of the UFO process, the attacker can execute any code that user has rights to, potentially compromising the host locally. This is an instance of CWE‑78: OS Command Injection.

Microsoft UFO, any release up to and including v3.0.0, is affected. Deployments running those releases are vulnerable whenever they process or replay stored action sessions.

The CVSS score of 7.8 signals high severity. An EPSS of 2% indicates a modest risk of exploitation. The vulnerability is not currently listed in the CISA KEV catalog, implying no publicly reported exploits. The attack requires the ability to write or modify session JSON files, meaning local access or compromise of the file system is needed. Once a malicious action is inserted, UFO’s replay logic will execute it, giving local command‑execution capability.