The reNgine web application is vulnerable to OS Command Injection through the custom_headers scan engine configuration field used by the fetch_url and dir_file_fuzz functions in the tasks module. A malicious user supplied value in this field can be concatenated into system commands without proper sanitization, allowing the attacker to execute arbitrary operating‑system commands on the server running reNgine. This flaw can compromise confidentiality, integrity, and availability of the affected system and any underlying infrastructure.

All installations of reNgine up to version 2.2.0 and the current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) are affected. Users of the open‑source reNgine tool should verify their deployment version.

Based on the description, it is inferred that the vulnerable input field is exposed via web requests and that remote attackers can trigger the payload from any network that can reach the reNgine endpoint. The likely attack vector is direct HTTP requests to the custom_headers parameter. The CVSS score is 9.8, indicating a critical severity. Without a publicly listed patch, the vulnerability remains exploitable. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited but the risk remains substantial.