CVE-2026-105791 in UFO
Summary
by MITRE • 10/06/2026
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the bash_command parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attacker-influenced agent call can launch an arbitrary executable or script as the desktop user even though the subprocess uses shell=False. Exploitation depends on a user running an affected agent workflow and on inducing the tool call, but successful execution can access or modify that user's files, tokens, and sessions. This issue is fixed in version 3.0.9.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Microsoft UFO prior to version 3.0.9 represents a critical command injection flaw within the CommandLineExecutor component of the local MCP server implementation. Specifically, the run_shell tool located in ufo/client/mcp/local_servers/cli_mcp_server.py exhibits insufficient input validation when processing bash_command parameters on Windows systems. The security defect stems from an overly simplistic parsing mechanism that validates only the first token of the command string while failing to adequately sanitize or restrict subsequent arguments passed to system executables. This architectural oversight allows for a classic argument injection scenario where malicious payloads embedded in later parts of the command line can be interpreted and executed by underlying Windows subsystems rather than being treated as literal data strings.
On Microsoft Windows operating systems, this flaw is particularly dangerous due to the behavior of explorer.exe. When the vulnerable code invokes explorer.exe with shell=False, it intends to prevent standard shell interpretation features such as piping or redirection that could facilitate more complex attacks. However, explorer.exe does not merely execute a binary; it acts as a host for various system functions and delegates certain path arguments directly to ShellExecute. This delegation mechanism bypasses the intended security boundary because ShellExecute is designed to handle file associations and protocol handlers dynamically. Consequently, an attacker who can influence the agent workflow inputs can craft a command string that appears benign in its initial token but contains malicious payloads in subsequent parameters which are then processed by ShellExecute as executable files or scripts.
The operational impact of this vulnerability allows for arbitrary code execution with the privileges of the desktop user running the affected agent workflow. Although exploitation requires an attacker to induce the specific tool call within a legitimate workflow, successful exploitation grants significant access to the local environment. The compromised session can be leveraged to read sensitive files, exfiltrate authentication tokens stored in memory or configuration files, and manipulate active browser sessions or other application states associated with that user account. This level of access effectively compromises the confidentiality, integrity, and availability of the user's digital identity and data on the local machine without requiring administrative privileges or network-based exploitation vectors.
This vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command, specifically reflecting patterns where input validation is incomplete or inconsistent across different parts of a command string. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, particularly those involving argument injection or the misuse of system utilities like explorer.exe for lateral movement or persistence. The reliance on ShellExecute delegation highlights risks associated with CWE-94 Improper Control of Generation of Code (Code Injection) where user input influences code execution paths through legitimate system components rather than direct interpreter invocation.
Mitigation strategies primarily involve upgrading to Microsoft UFO version 3.0.9 or later, which addresses the root cause by implementing robust validation for all tokens within the bash_command parameter and restricting the use of explorer.exe in contexts that could lead to ShellExecute delegation vulnerabilities. In environments where immediate patching is not feasible, administrators should enforce strict allow-lists on executable paths invoked by automation agents and disable unnecessary MCP server functionalities if they are not required for business operations. Additionally, implementing least-privilege principles for user accounts running these workflows can limit the blast radius of a successful exploitation attempt by restricting access to sensitive files and tokens.