CVE-2026-45322

Vulnerability

Microsoft UFO open-source framework for intelligent automation versions up to and including v3.0.0 contain an OS command injection vulnerability in the shell action replay path [1]. The ShellReceiver.run_shell() method passes a command string from action parameters directly to subprocess.Popen() with shell=True and executable=powershell.exe, as seen in ufo/automator/app_apis/shell/shell_client.py [1]. The same behavior is reachable through ShellReceiver.execute_command(). The shell receiver is invoked by action classes such as RunShellCommand.execute() and ExecuteCommand.execute(), which forward stored action parameters to the shell receiver [1]. An attacker who can write or modify a session/action JSON file can plant a shell action; when the session is resumed or replayed, UFO executes the attacker's command as the UFO process user [1].

Exploitation

An attacker needs the ability to write or modify a stored UFO session/action JSON file [1]. The attacker plants a malicious shell action with an arbitrary command string using PowerShell syntax or shell metacharacters. When the session is resumed or replayed, the stored JSON is read by RunShellCommand.execute() or ExecuteCommand.execute(), which forwards the parameters to ShellReceiver.run_shell() [1]. The method passes the command directly to subprocess.Popen(command, shell=True, executable=powershell.exe) [1]. Because shell=True is used, PowerShell interprets the injected metacharacters, resulting in OS command execution [1]. No user interaction beyond the attacker-controlled write is required for successful exploitation [1].

Impact

On successful exploitation, the attacker achieves arbitrary OS command execution with the privileges of the UFO process user [1]. This can lead to full information disclosure, modification, or deletion of data, installation of malicious software, or escalation of privileges depending on the process context [1]. The scope of compromise is limited to the security context of the UFO process user, but the attacker gains the ability to execute any PowerShell command [1].

Mitigation

The issue was silently hardened on the main branch around 2026-03-25 by removing shell=True and using an explicit argument list, but no patched tagged release has been published [1]. The latest tagged release, v3.0.0, remains affected [1]. As of the publication date (2026-05-27), no official patch or workaround is available in a tagged release [1]. Users are advised to avoid using session replay with untrusted JSON files or to apply the code change from the main branch manually [1]. The CVE is not yet listed in the KEV catalog.