CVE-2026-105791
HIGH 7.5Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the bash_command parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attacker-influenced agent call can launch an arbitrary executable or script as the desktop user even though the subprocess uses shell=False. Exploitation depends on a user running an affected agent workflow and on inducing the tool call, but successful execution can access or modify that user's files, tokens, and sessions. This issue is fixed in version 3.0.9.
Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.7%chance of exploitation in 30 days · 54th percentile
Impact if exploited
7.5CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-88: : Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
- CWE-184: : Incomplete List of Disallowed Inputs
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References and research data (JSON)
All CVSS metrics
- HIGH 7.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - HIGH 7.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/microsoft/UFO/security/advisories/GHSA-cmq9-vqjf-4q2q CVE record · GitHub_M · Updated 2026-10-06T14:09:23.272Z
CVE record · CISA-ADP · Updated 2026-10-09T01:01:55.969Z
NVD · CVE-2026-105791 · Updated 2026-10-09T02:16:54.857
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93419 EUVD · EUVD-2026-93419
Technical & other
- https://github.com/microsoft/UFO/commit/3e1262fc091eb319253b7a1338b63f62cc6c82b1 CVE record · GitHub_M · Updated 2026-10-06T14:09:23.272Z
NVD · CVE-2026-105791 · Updated 2026-10-09T02:16:54.857 - https://github.com/microsoft/UFO/releases/tag/v3.0.9 CVE record · GitHub_M · Updated 2026-10-06T14:09:23.272Z
NVD · CVE-2026-105791 · Updated 2026-10-09T02:16:54.857