CVE-2026-105791

Executive Summary

CVE-2026-105791 is an argument injection vulnerability (CWE-88) in Microsoft's open-source UFO framework, specifically within the run_shell tool of the CommandLineExecutor component. The flaw allows an attacker-influenced agent call to launch an arbitrary executable or script as the desktop user by leveraging explorer.exe argument delegation through ShellExecute, even though the subprocess is invoked with shell=False. All deployments of Microsoft UFO prior to version 3.0.9 are affected. Successful exploitation requires user interaction (running an affected agent workflow and inducing a specific tool call) but yields high confidentiality, integrity, and availability impact within the context of the victim user's session.

Technical Analysis

The vulnerability resides in the file ufo/client/mcp/local_servers/cli_mcp_server.py, within the CommandLineExecutor component. The run_shell tool accepts a bash_command parameter. The validation logic in affected versions inspects only the first token of the supplied command and permits explorer.exe as a valid executable. Because explorer.exe on Windows delegates its following path argument to the ShellExecute API, an attacker who can influence the agent's tool call can supply a command such as explorer.exe <path-to-malicious-executable-or-script>. The subprocess is created with shell=False, which normally prevents shell metacharacter injection; however, this defense is bypassed because the injection is not shell-based but rather an argument-level delegation inherent to explorer.exe behavior. The validation gap is that the first-token allowlist does not account for the argument-forwarding semantics of the permitted binary.

The attack surface includes any deployed instance of the Microsoft UFO framework where an agent workflow invokes the run_shell tool and where the bash_command argument can be influenced by external input, model output, or a malicious task definition. The vulnerability class is argument injection (CWE-88): improper neutralization of argument delimiters in a command. Prior to version 3.0.9, there is no evidence of upstream remediation, and no vendor advisory, OSV package entry, or patch source has been identified in the provided intelligence.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification: An attacker identifies a host or CI runner where the Microsoft UFO agent framework is installed at a version prior to 3.0.9 and where agent workflows are executed. Target identification may occur through social engineering, supply chain positioning, or by delivering a malicious task definition that the agent will process.

2. Triggering the Flaw Class: The attacker induces the agent to invoke the run_shell tool with a bash_command parameter whose first token is explorer.exe followed by a path argument pointing to an attacker-controlled executable or script. Because the validation logic accepts explorer.exe as the first token, the command passes the allowlist check. No shell metacharacters are required, so shell=False offers no protection.

3. Payload Execution Method: On Windows, explorer.exe delegates the following path argument to ShellExecute. This causes the referenced executable or script to be launched under the security context of the desktop user running the agent. The attacker does not need to exploit a memory corruption bug or bypass OS-level mitigations; the delegation behavior is a documented function of explorer.exe.

4. Post-Exploitation Impact: The launched payload executes as the desktop user, granting access to that user's files, tokens, and sessions. An attacker could exfiltrate data, modify files, harvest credentials, or establish persistence, all within the user's privileges. Exploitation depends on user interaction (running the affected agent workflow and inducing the tool call), which is reflected in the CVSS vector's UI:R and the AC:H rating.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The network attack vector (AV:N) indicates the vulnerability can be triggered remotely, but the high attack complexity (AC:H) and required user interaction (UI:R) mean exploitation is not trivial and depends on specific conditions. No privileges are required (PR:N), and the scope is unchanged (S:U). Confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H) because the attacker can access or modify the victim user's files, tokens, and sessions. Business impact includes potential data loss, credential compromise, and lateral movement within an organization where UFO agents are deployed. The blast radius is limited to the security context of the user running the affected agent workflow, but in CI/CD or automation environments, that context may hold elevated privileges or access to sensitive repositories and secrets.

Detection Guidance

Sigma Rule

title: Potential Microsoft UFO Argument Injection via explorer.exe
id: 8f3c2b1a-4d5e-6f7a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects execution of explorer.exe with a path argument following the Microsoft UFO run_shell tool abuse pattern (CVE-2026-105791)
author: valtersit.com
date: 2026-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\explorer.exe'
    selection_parent:
        ParentImage|endswith:
            - '\python.exe'
            - '\pythonw.exe'
            - '\ufo.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'explorer.exe '
    condition: selection_img and (selection_parent or selection_cmdline)
falsepositives:
    - Legitimate user launching explorer via scripted automation
    - Administrative scripts that open folders programmatically
level: high

YARA Rule

rule CVE_2026_105791_UFO_Explorer_Abuse
{
    meta:
        description = "Detects references to the Microsoft UFO CLI MCP server component abused in CVE-2026-105791"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105791"
        severity = "high"
    strings:
        $s1 = "cli_mcp_server.py" ascii wide
        $s2 = "CommandLineExecutor" ascii wide
        $s3 = "run_shell" ascii wide
        $s4 = "bash_command" ascii wide
        $s5 = "explorer.exe" ascii wide nocase
        $s6 = "shell=False" ascii wide
    condition:
        uint16(0) == 0x5A4D or
        (2 of ($s1, $s2, $s3, $s4) and any of ($s5, $s6))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-105791 Microsoft UFO run_shell explorer.exe Argument Injection Attempt"; flow:established,to_server; content:"bash_command"; http_client_body; nocase; content:"explorer.exe"; http_client_body; nocase; distance:0; within:256; reference:cve,2026-105791; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105791; classtype:attempted-user; sid:2026105791; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : "explorer.exe" and
  process.parent.name : ("python.exe", "pythonw.exe", "ufo.exe") and
  process.command_line : "*explorer.exe *"

Splunk SPL Query

index=windows_sysmon EventCode=1 Image="*\\explorer.exe"
| where match(CommandLine, "(?i)explorer\\.exe\\s+.+")
| search ParentImage IN ("*\\python.exe", "*\\pythonw.exe", "*\\ufo.exe")
| table _time, host, User, ParentImage, Image, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="windows,sysmon,ufo,">
  <rule id="2026105" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">\\\\explorer\.exe</field>
    <field name="win.eventdata.parentImage">\\\\python(w)?\.exe|\\\\ufo\.exe</field>
    <field name="win.eventdata.commandLine">explorer\.exe\s+.+</field>
    <description>CVE-2026-105791: Possible Microsoft UFO explorer.exe argument injection (run_shell abuse)</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_105791,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 3.0.9; however, no vendor advisory, OSV entry, or repository commit has been confirmed by tracked sources, so treat this as unverified until independently validated.

1. Immediate Mitigations:

   • Disable or restrict the run_shell tool in the CommandLineExecutor component until version 3.0.9 can be validated and deployed.
   • Harden the first-token validation to reject explorer.exe entirely, or require a strict allowlist of executable names without argument-forwarding semantics.
   • Restrict agent workflows to trusted, signed task definitions and prevent external input from influencing bash_command.
   • Run UFO agents under a low-privilege service account with no access to sensitive user files, tokens, or sessions.
   • Monitor for explorer.exe spawning from Python or UFO parent processes and alert on anomalous path arguments.

2. Patch / Upgrade Steps:

   • Upgrade Microsoft UFO to version 3.0.9 or later once the release is independently confirmed.
   • Verify the integrity of the upgrade package and validate the fix in a staging environment before production rollout.
   • Re-test the run_shell validation logic to confirm that explorer.exe with a path argument is rejected.

3. Long-Term Hardening:

   • Implement multi-token or semantic validation for command parameters rather than first-token allowlisting.
   • Adopt a deny-by-default policy for shell tool execution in agent frameworks.
   • Apply least privilege to all agent execution contexts and isolate automation runners from user desktop sessions.
   • Conduct regular security reviews of MCP local server components and their tool-call interfaces.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105791
• Microsoft UFO Project (GitHub): https://github.com/microsoft/UFO
• CWE-88: Improper Neutralization of Argument Delimiters in a Command: https://cwe.mitre.org/data/definitions/88.html
• MITRE ATT&CK T1204 — User Execution: https://attack.mitre.org/techniques/T1204/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-105791 is NOT listed as of this report; no exploit-in-the-wild evidence or threat actor campaign has been identified)