navi, a command assistance tool, contains an OS command injection flaw where variable values from cheatsheets are inserted into shell commands without proper escaping. A crafted file name in a suggestion command directory can introduce shell metacharacters, allowing an attacker to execute arbitrary commands with the privileges of the user running navi. The weakness is characteristic of CWE-78, where insufficient sanitization of user-supplied input leads to code execution.

The vulnerability affects the denisidoro:navi product, specifically all releases up to and including version 2.24.0. Any deployment of navi 2.24.0 or earlier is potentially exposed.

The CVSS base score of 7.3 indicates high severity. EPSS data is not available, so the exact exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at the time of assessment. The likely attack vector involves an attacker placing specially named files in a suggestion directory that the victim subsequently accesses, resulting in command execution. The flaw does not require network exposure; local file manipulation suffices, so any user who can influence the suggestion directories poses a risk.