CVE-2026-45322

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection vulnerability in the shell action replay path. In affected releases, ShellReceiver.run_shell() passes a command string from action parameters directly to subprocess.Popen() with shell=True and executable=powershell.exe. The same shell-execution behavior is also reachable through ShellReceiver.execute_command(). The shell receiver is invoked by action classes such as RunShellCommand.execute() and ExecuteCommand.execute(), which forward stored action parameters to the shell receiver. Because UFO stores planned and executed actions in per-session JSON records, an attacker who can write or modify a session/action JSON file can plant a shell action. When the session is resumed or replayed, UFO executes the attacker's command as the UFO process user.

• CWE-78

• https://github.com/microsoft/UFO/security/advisories/GHSA-wj72-7w8h-695f
• https://github.com/microsoft/UFO/security/advisories/GHSA-wj72-7w8h-695f

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45316Open WebUI is a self-hosted artificial intelligence platform…3.5
• CVE-2026-45317Open WebUI is a self-hosted artificial intelligence platform…4.6
• CVE-2026-45318Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-4532A security vulnerability has been detected in code-projects …7.5
• CVE-2026-45320DataEase is an open source data visualization and analysis t…8.7
• CVE-2026-45321On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84…9.6
• CVE-2026-45323MeshCore Card provides MeshCore Lovelace card for Home Assis…9.6
• CVE-2026-45324Rizin is a UNIX-like reverse engineering framework and comma…3.3
• CVE-2026-45325Gestor de Oferta is a web application for managing mobility …8.2
• CVE-2026-45327TinyIce is a streaming server for audio and video. In versio…8.2
• CVE-2026-45328ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8.8
• CVE-2026-45329ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.5