Greenshot, an open‑source Windows screenshot utility, contains an OS Command Injection flaw in the ExternalCommand plugin. The FormatArguments method concatenates user-controlled filenames directly into shell commands without sanitization. A crafted filename with shell metacharacters can cause Greenshot to execute arbitrary commands, enabling an attacker to gain local command execution on any system where the vulnerable version runs. The vulnerability maps to CWE‑78 and can compromise both the confidentiality and integrity of the affected system.

The flaw affects Greenshot versions 1.3.310 and all earlier releases. Users running these versions on Windows should be aware that unsanitized filenames processed by the ExternalCommand plugin can be used to inject commands.

The CVSS score of 7.8 indicates a high severity level, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. Greenshot is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability can be exploited via local delivery of a malicious file name or by an attacker who can place a specially crafted file in a location that Greenshot processes. Because the flaw requires local execution of Greenshot, the attack vector is most likely local and requires that the user runs the application or that an attacker can influence the file name used during capture.