CVE-2026-105791

Summary

The flaw allows attackers to execute arbitrary executables or scripts as the desktop user by exploiting a validation issue in the run_shell tool of Microsoft UFO's CommandLineExecutor component. This occurs because explorer.exe delegates path arguments to ShellExecute, bypassing shell=False restrictions and enabling privilege escalation through user workflows.

Exploitability

Exploitation requires user interaction with an affected agent workflow and inducing a tool call, making it moderately difficult but achievable with social engineering or compromised workflows.

Blast radius

If exploited, attackers can access or modify the user's files, tokens, and sessions, potentially leading to full system compromise or lateral movement within the organization.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.0.9 or later to fix the shell command validation issue in CommandLineExecutor.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.