The vulnerability exists in the go2rtc component of Frigate when parsing the video stream configuration file (config.yaml). A user who can edit this file may insert a command via the exec: directive, and the go2rtc service will run the supplied command without input validation. The flaw is categorized by multiple common weaknesses, including improper authorization, lack of input validation, and unsafe command execution, which together allow an attacker to execute arbitrary code and potentially escape the container environment.

Frigate, a network video recorder produced by blakeblackshear, is vulnerable in all releases before version 0.16.4. The flaw is exploitable by anyone with administrative rights or by any user who accesses an internet‑exposed Frigate instance without authentication, giving them full control of the host system.

The CVSS score of 9.1 marks the issue as critical. The EPSS score of 3% indicates a non‑negligible likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely, either by authenticating as an administrator or by simply accessing an exposed Frigate installation over the public internet. Successful exploitation results in complete administrative control and the ability to escape the container, effectively compromising the entire host.