The vulnerability originates in the go2rtc integration of Frigate, allowing a user who can edit the video stream configuration file (config.yaml) to insert a system command via the exec: directive. The injected command is executed by the go2rtc service with no input sanitization, giving the attacker complete control over the host system. This flaw corresponds to several common weaknesses, including improper authorization (CWE-250, CWE-269), lack of input validation (CWE-668), and unsafe command execution (CWE-78).

The affected product is Frigate, developed by blakeblackshear. All installations running a version prior to 0.16.4 are vulnerable. Users who expose Frigate to the internet without authentication or who have administrative privileges can exploit this flaw.

With a CVSS score of 9.1, the severity is critical. The EPSS score is below 1%, indicating a very low probability of public exploitation as of the data available, and it is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the vulnerability can be triggered through remote manipulation of the config.yaml file, and because the attack requires either administrative credentials or an open internet-facing Frigate instance, the likely attack vector is remote authenticated or unauthenticated access, respectively. Successful exploitation would grant complete control of the host and the ability to escape the container environment.