The vulnerability involves unintended processing of the LogMod.js module in the Log Viewer Endpoint of vertex-app vertex. By sending a crafted value in the query string parameter of a request, an attacker can control the content that is passed to an operating system command, resulting in OS command injection and allowing execution of arbitrary shell commands on the underlying host.

Affected systems are deployments of the vertex-app vertex application, any version up to and including 2026.02.12. The vulnerability originates from the Log Viewer Endpoint component and is triggered through unchecked req.query handling.

The CVSS score of 5.3 indicates a moderate severity, but the lack of an EPSS score and absence from CISA KEV suggest the threat is not yet widely exploited. However, the publicly available exploit and remote nature of the attack raise concern. The attacker can gain command execution with the privileges of the web service, potentially compromising confidentiality, integrity, and availability.