Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105789— Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool

Quick assessment

Affected
microsoft UFO
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Microsoft UFO 是一个跨设备和平台的开源智能自动化框架。在 3.0.9 版本之前，位于 中的 工具将 和 视为只读命令。然而，由于支持自由格式的命令行参数，这些命令的文件输出形式仍可被调用。 经过身份验证的用户可以利用 或 的可选第二个操作数，在不使用 shell 元字符的情况下，创建或覆盖 UFO 服务器进程具有写入权限的文件。这是因为受允许的指令会自行打开目标文件，而当前的参数策略并未拒绝此类操作。该漏洞可能导致配置文件或其他可写数据损坏，并破坏服务正常运行。但所演示的攻击原语不会直接泄露文件，也无

CVSS 5.4 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105789

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool
Source: CVE Program / CVE List V5
Vulnerability Description
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/http_servers/linux_mcp_server.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output forms. An authenticated caller can use sort -o or the optional second uniq operand to create or overwrite files writable by the UFO server process without shell metacharacters, because the allowed binary opens the destination itself and the argument policy does not reject the operation. This can corrupt configuration or other writable data and disrupt the service, but the demonstrated primitive does not directly disclose files or establish arbitrary code execution. This issue is fixed in version 3.0.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
microsoft UFO < 3.0.9 -

II. Public POCs for CVE-2026-105789

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105789

请登录查看更多情报信息。

Other References for CVE-2026-105789 (4)

Same Patch Batch · microsoft · 2026-10-06 · 11 CVEs total

CVE-2026-105794 9.1 CRITICAL MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
CVE-2026-105793 9.1 CRITICAL Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
CVE-2026-105797 8.8 HIGH SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spaw
CVE-2026-105796 8.8 HIGH Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP gene
CVE-2026-105788 8.8 HIGH Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and l
CVE-2026-105798 8.7 HIGH SimpleChat: Stored XSS via group document filename in inline onclick handler
CVE-2026-105791 7.5 HIGH Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injecti
CVE-2026-105792 6.5 MEDIUM Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager
CVE-2026-105790 6.4 MEDIUM Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinni
CVE-2026-105795 3.1 LOW Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

IV. Related Vulnerabilities

Same product: UFO
Same vendor: microsoft
Same weakness: CWE-88

V. Comments for CVE-2026-105789

No comments yet

Leave a comment