Fluxion before 6.39 contains an OS command injection flaw in the fluxion.sh target scanner. The script decodes access point ESSIDs using eval after escaping only single quotes. This allows an attacker to craft a SSID that, when the operator scans or selects it, will be evaluated as a shell command and executed with root privileges. The result is full compromise of the system running Fluxion, exposing confidentiality, integrity, and availability.

Fluxion by FluxionNetwork, any release before v6.39, including 6.32 and earlier. The vulnerability exists in the fluxion.sh component of these versions.

The CVSS score of 8.6 classifies it as high severity. EPSS is not reported, and the issue is not listed in CISA KEV, but the attack scenario is straightforward: an attacker needs to be in Wi‑Fi range and broadcast a crafted SSID. Because the target operator must manually scan or accept the SSID, the exploit requires local network proximity but not privileged user interaction beyond normal usage.