A command injection flaw exists in the h-ui administrative API for versions v0.0.25 and earlier. The flaw arises because the listen configuration field is not validated; an authenticated administrator can supply shell metacharacters which are incorporated into nftables/iptables rule strings via fmt.Sprintf and executed by the system shell as root. This allows the attacker to run arbitrary OS commands with kernel-level privileges, significantly compromising confidentiality, integrity, and availability of the host system.

The vulnerability affects the h-ui application distributed by jonssonyan, specifically any installation running version v0.0.25 or earlier. Systems that expose the administrative API with an authenticated administrator credential are eligible.

Exploitability is high for individuals who can acquire legitimate administrator access. An attacker must authenticate to the h-ui API, then submit a crafted value for the listen field; the system will execute the embedded command as root due to the use of bash ‑c. The vulnerability carries a CVSS score of 9.1, indicating critical severity. The EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, but the lack of input validation combined with root execution means that a successful attack effectively elevates to system‑wide control.