Read the docs
TI-2026-53243 Aliases CVE-2026-76055GHSA-xgr7-5g33-wgpv

OS command injection in blackduck-c-cpp

Priority LOW 34CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Improper Neutralization of Special Elements used in an OS Command in the package manager component of Black Duck blackduck-c-cpp before 3.0.7 allows an actor able to create a file within the scanned build directory to execute operating system commands as the account running the scan. Filesystem paths encountered while traversing the scanned directory are interpolated into command strings that are executed through a shell without quoting or escaping, so shell metacharacters within those paths are interpreted rather than treated as literal text. No control over the build command or the tool's configuration is required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed blackduck-c-cpp (Black Duck): 3.0.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Black Duckblackduck-c-cppbefore 3.0.73.0.7Patch availableCNA
  • blackduck-c-cpp VendorBlack Duck Affected before 3.0.7 Fixed in 3.0.7 Patch available CNA

Remediation

  • Fix · CNA blackduck-c-cpp (Black Duck) Fixed in 3.0.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Black Duck blackduck-c-cpp — Black Duck Product Security Advisory

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-53242 Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp…Priority LOW 30
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76055
  2. 2026-10-03 Alias added: GHSA-xgr7-5g33-wgpv

References

Advisory 1

Other 1

  • TI-2026-01191 Coverity CLI Authentication Bypass CVSS 4.0CRITICAL 9.3
  • TI-2026-07338 Authentication and Authorization Bypass in Coverity Connect CVSS 4.0CRITICAL 9.2
  • TI-2026-07339 SQL Injection in Coverity Connect SOAP API CVSS 4.0HIGH 8.7
  • TI-2024-11153 Stored cross-site scripting in Black Duck Coverity CVSS 4.0HIGH 8.5
  • TI-2026-53242 Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp… CVSS 4.0HIGH 7.1
  • TI-2025-00418 Black Duck SCA Project Privilege Escalation CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences