Improper neutralization of special elements used in a command enables command injection, allowing an attacker to execute arbitrary code on Azure Pipelines build agents. This represents a high‑impact threat that can compromise confidentiality, integrity, and availability of build environments.

Microsoft Azure Pipelines is affected. No specific version information is provided, so all current instances of Azure Pipelines are considered potentially vulnerable until a fix is applied.

The CVSS score of 9.1 marks the vulnerability as critical. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog, but the attack vector is likely network‑based, with an unauthorized pipeline trigger providing the means to inject commands. If exploited, an attacker could gain full control over the build agent’s operating system.