The vulnerability is an operating‑system command injection flaw that enables an authenticated attacker to run arbitrary commands on the host machine. The flaw arises from the handling of user‑controlled input during command construction, allowing malicious payloads to be executed with the privileges of the running SHIRASAGI process. This can lead to full system compromise, data exfiltration, or further lateral movement by the attacker.

The product affected is SHIRASAGI from the SHIRASAGI Project. The vulnerability applies to all releases of the product that have not applied the recent security update referenced in the advisories. Specific version numbers are not listed in the advisories, so all unpatched installations are potentially vulnerable.

The CVSS score of 8.7 indicates high severity, while the EPSS score is not available. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The likely attack path requires valid user credentials and access to the vulnerable interface that accepts unsanitized input. Once accessed, an attacker can inject command payloads that are executed with the service account’s privileges, potentially leading to system takeover.