ngrok versions 4.3.3 and 5.0.0-beta.2 contain a command injection flaw that allows an attacker to run arbitrary operating‑system commands with the privileges of the ngrok process. This weakness can lead to full compromise of confidentiality, integrity, and availability of the host system. The vulnerability is a classic OS command‑injection flaw, referenced by CWE-77, and is triggered when untrusted input is improperly handled by ngrok internally.

The affected products are ngrok 4.3.3 and 5.0.0-beta.2. No other vendor or product information is documented. Users running these specific releases should verify their version and evaluate exposure.

No EPSS score is reported and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. The CVSS score of 8.8 highlights a high severity. Based on the description, it is inferred that the likely attack vector is a remotely exploitable endpoint exposed by ngrok when it processes untrusted input. If an attacker can interact with the vulnerable service, they can achieve remote code execution by injecting malicious commands.