The Zen C compiler contains a command injection flaw in its front end. When the -o output filename option is supplied, the compiler concatenates the filename into a shell command that is executed via system(). Because shell metacharacters in the filename are interpreted, an attacker who can influence the -o value can run arbitrary commands with the privileges of the compiler process. The vulnerability is classified as CWE‑78.

Z‑libs Zen‑C versions earlier than 0.4.2 are affected. The flaw exists in the main application logic located in src/main.c of the project. Users who invoke the zc compiler directly from a local machine, or who run automated build scripts or CI/CD pipelines that supply the -o argument, may be impacted.

The CVSS score of 6.6 indicates a moderate severity. The EPSS score of less than 1% suggests that active exploitation is presently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is local because the attacker must supply a crafted value to the -o option when the compiler is run locally; remote exploitation is not supported by the information provided. The impact allows an attacker with local build‑system access to execute arbitrary commands, which could lead to full compromise of that environment and potentially privilege escalation if the compiler runs with elevated rights.