The vulnerability in Arduino App Lab arises from insufficient validation of input data received from connected hardware, specifically the _info.Serial and _info.Address metadata fields used during device information handling. Because these fields do not enforce strict sanitization, an attacker who controls the connected board can supply specially crafted strings that include shell metacharacters. When the host system processes these values, the injected payload is executed with the privileges of the user running Arduino App Lab, exposing the host operating system to command execution that effectively bypasses normal application constraints.

The affected product is Arduino App Lab for all versions prior to 0.4.0. Vendors and versions are identified as arduino:arduino-app-lab with any subvariant. The vulnerability was fixed in release 0.4.0, so installations of that version or later are not impacted.

The CVSS Base Score of 6.9 indicates moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV catalog. Exploitation requires direct physical access to a compromised or tampered board and then connecting it to a host running the vulnerable version of Arduino App Lab. Once the connection is established, the host processes the injected shell metacharacters, which results in elevated command execution under the current user context. Given the moderate CVSS score, low EPSS, and requirement for physical access, the overall risk to systems is moderate, but any compromised board could lead to local code execution on the host machine.