Microsoft UFO: Arbitrary code execution via explorer.exe argument injection in run_shell
Summary
Microsoft UFO, an open-source framework for agents that automate a Windows desktop, is affected before version 3.0.9. The run_shell tool only checks the first token of a command and allows explorer.exe, which passes its path argument to ShellExecute, so an attacker-influenced agent call can start an arbitrary executable or script as the logged-in user. Exploitation requires a user to run an affected agent workflow and an induced tool call, but successful execution can access or modify that user's files, tokens and sessions.
Affected
- Microsoft UFO versions before 3.0.9
Fixed in
- Version 3.0.9 (fix commit 3e1262fc091eb319253b7a1338b63f62cc6c82b1)
Workaround
- Unknown. The vendor documents upgrading as the remedy.
- Interim measure (general practice, not vendor-published): stop running UFO agent workflows on untrusted input and disable the run_shell tool where it is not needed.
Exploitation
- CISA SSVC: exploitation status poc (proof of concept exists), not automatable.
- Not listed in the CISA KEV catalogue; no evidence of exploitation in the wild found.
- Public proof of concept: none found in research; this does not rule one out.
Our recommendation
- Check whether UFO or similar agent frameworks are installed on workstations.
- If installed, upgrade to version 3.0.9 or later, preferably the latest release.
- Restrict the agent's tool permissions and run it as a standard user without access to sensitive files or sessions.
- If not installed, this is low priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub security advisory GHSA-cmq9-vqjf-4q2q github.com
- Fix commit 3e1262fc091eb319253b7a1338b63f62cc6c82b1 github.com
- UFO release v3.0.9 github.com
- OSV record CVE-2026-105791 osv.dev
- OpenCVE CVE-2026-105791 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 22:12.
Original description (NVD)
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the bash_command parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attacker-influenced agent call can launch an arbitrary executable or script as the desktop user even though the subprocess uses shell=False. Exploitation depends on a user running an affected agent workflow and on inducing the tool call, but successful execution can access or modify that user's files, tokens, and sessions. This issue is fixed in version 3.0.9.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.