Executive brief
Black Duck's C/C++ analysis tool includes a package manager component that scans source code directories for vulnerabilities. An attacker who can place files with special characters in the build directory can manipulate the tool into executing arbitrary operating system commands with the privileges of the scan process, potentially compromising the build pipeline and accessing sensitive code or systems.
Technical details
This is an OS command injection vulnerability (CWE-78) in the package manager component of Black Duck blackduck-c-cpp. The vulnerability occurs because filesystem paths encountered during directory traversal are interpolated directly into shell command strings without proper quoting or escaping. An attacker with the ability to create files in the scanned build directory can embed shell metacharacters in filenames, which are then interpreted by the shell during command execution rather than treated as literal path components. No special configuration or control over the build command is required to exploit this. The attacker can execute arbitrary commands as the user account running the scan, leading to potential code execution, data exfiltration, or lateral movement. The vulnerability affects versions before 3.0.7, and a patch is available.
Affected products
- Black Duck blackduck-c-cpp before 3.0.7
Timeline
- 2026-08-24: disclosed