HCL BigFix RunBookAI is affected by a flaw in input handling that can allow an attacker to inject or smuggle malicious commands. The vulnerability enables unauthorized command execution, giving the attacker control over the application and potentially the underlying system. The weakness is categorized by CWE-351, CWE-451, and CWE-77, indicating a failure to properly validate input, combined with a potential for command smuggling or injection.

The affected product is HCL: BigFix RunBookAI. The publicly available data does not specify individual version numbers or build identifiers.

The CVSS score of 8.8 indicates a high severity and that the vulnerability could lead to full compromise of the affected system. EPSS data is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation yet. Based on the description, the potential attack vector likely requires that an attacker can input data into the vulnerable component, which may be possible through authenticated or unauthenticated interfaces. The lack of an explicit attack vector in the information means that the safest assumption is that the attacker can supply crafted input to trigger command execution.