A vulnerability in OpenBullet2 allows an authenticated user to upload script files such as .bat, .ps1 or .sh through the FileProxySource proxy loading feature. When these files are uploaded, the server stores them and then executes them, returning the resulting output as proxy lines. This enables an attacker to run arbitrary commands on the host system under the privileges of the process user, leading to complete compromise of confidentiality, integrity, and availability of the affected machine.

OpenBullet2, versions up to and including 0.3.2, is affected. The vulnerability exists in all releases prior to 0.3.3 and will be resolved in the next patch.

The CVSS score of 8.7 indicates high severity. Although the EPSS score is not available, the vulnerability requires the attacker to be authenticated, which narrows the attacker pool but still poses significant risk in environments where credentials are compromised or weak. The attack is carried out by uploading a malicious script and then viewing the output; the servers privileges are leveraged, so an exploit would cause system-wide control. The vulnerability is not listed in the CISA KEV catalog, which suggests there are no known widespread exploit instances yet, but the high CVSS combined with authenticated access makes it a priority concern.