An attacker can exploit a command injection flaw in the api-gateway-deploy entrypoint logic. The vulnerability allows execution of arbitrary OS commands with root privilege inside the container. This can lead to a container escape scenario or allow the attacker to modify interior infrastructure, compromising confidentiality, integrity and availability of the host system. The weakness corresponds to several CWEs such as command injection, privilege escalation, and insecure input handling.

The affected product is bleon-ethical api-gateway-deploy version 1.0.0. The vulnerability exists in the container runtime environment that relies on a privileged entrypoint script that does not properly validate user inputs and runs as root.

The flaw carries a high CVSS score of 9.2, indicating a severe impact. EPSS is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to send crafted input that reaches the vulnerable script, after which the injected command runs with root rights inside the container. From there, the attacker may already have sufficient control to perform unauthorized actions on the host or other services.