CVE-2021-44041: Uipath Assistant

Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days.

UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.

Affected products

• Uipath Assistant: version 21.4.4 only

Published 2021-12-14. Last modified 2026-06-17.