The vulnerability is an OS command injection flaw in Apache Kylin that allows an attacker to execute arbitrary operating‑system commands through the Kylin service. If the affected service is exposed, the flaw can lead to full system compromise for the host running Kylin. The weakness is classified as CWE‑78 and directly affects the way Kylin processes untrusted input.

Apache Kylin versions from 4.0.4 through 5.0.4 are susceptible to this flaw. The impact is primarily for Kylin deployments that expose the service to the public internet; internal, non‑public deployments are less likely to be directly impacted.

The CVSS score is 8.8, indicating high severity. The EPSS score of 1% indicates a low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote access to the Kylin service interface, which could allow an attacker to craft input leading to command execution on the underlying host. Consequently, the risk is high for publicly exposed instances while constrained internal deployments mitigate exposure.