This vulnerability stems from improper neutralization of argument delimiters in a command, allowing injected arguments to be interpreted as part of a system command line (CWE‑88). In pardus-software, untrusted input can be passed directly to a shell or other executor, enabling attackers to run arbitrary commands with the privileges of the software process. The high CVSS score of 8.8 reflects the potential for full command execution and loss of confidentiality, integrity, or availability of the affected system.

The flaw is present in TUBITAK BILGEM Software Technologies Research Institute’s pardus-software version 1.0.4 and all earlier releases. The issue is resolved in version 1.0.5 and later; therefore, any deployment running a version earlier than 1.0.5 is vulnerable.

The vulnerability carries a high‑severity CVSS score of 8.8, indicating a serious impact if exploited. Its EPSS score of < 1 % implies a very low probability of being targeted in the near term, and it has not yet been added to CISA’s KEV catalog. Attackers would need to supply crafted input that bypasses sanitization and is passed to the system shell, allowing injected commands to execute with the software’s process privileges. Because the likely attack vector involves local or remote code submission that is concatenated into a command line, preventing proper argument neutralization mitigates the risk.