A command injection vulnerability exists in the payload build page of BYOB (Build Your Own Botnet) version 2.0. By manipulating the build parameter, an attacker can cause the server to execute arbitrary operating‑system commands as the web application user. This flaw permits remote code execution, potentially compromising the entire host system. The weakness is a classic command injection flaw classified as CWE-77.

The affected product is BYOB (Build Your Own Botnet) 2.0, an open‑source tool for building botnet payloads. No other product versions are listed as vulnerable. Vendor information was not provided by the CNA, so the assessment is limited to the BYOB identifier and its core/generators.py module.

The CVSS score of 7.3 indicates high severity, and the EPSS score of 60% reflects a relatively high probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is the public or unprotected payload build endpoint, which an attacker can access without authentication. When triggered, the flaw allows execution of arbitrary commands with the privileges of the web application process, leading to full compromise of the host. Additional exploitation requires only network connectivity to the target system and the ability to send a crafted build request.