The vulnerability is an Argument Injection flaw that exists in the traceroute module of bird‑lg‑go before a specific commit. The implementation uses shlex.Split without validating user input, enabling a remote attacker to embed arbitrary command flags such as -w or -q through the q parameter. This injection can lead to excessive consumption of system resources, resulting in a denial of service.

xddxdd:bird-lg-go is affected. The vulnerability applies to any instance of the project prior to the commit that introduces the input validation fix. Users should verify the commit hash of their installed version.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests low but nonzero exploit probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending a specially crafted request to the traceroute module, injecting flags that deplete system resources and trigger a service crash. The required components are the vulnerable software and network connectivity to the traceroute interface.