A vulnerable version of osctrl allows an authenticated administrator to embed arbitrary shell commands into the hostname field of an environment configuration. These commands become part of the enrollment one‑liner script generated with Go's text/template package, which does not escape shell input, and are executed as root or SYSTEM when an endpoint enrolls. The attacker can install backdoors, exfiltrate credentials, and gain full control of any endpoint that uses the compromised environment. The weakness is an OS Command Injection flaw (CWE‑78).

The affected product is jmpsec’s osctrl, with all releases prior to version 0.5.0 vulnerable. Users running earlier revisions should verify the version and consider upgrading.

The vulnerability carries a CVSS score of 7.4, indicating high severity. The EPSS score is below 1%, meaning active exploits are rarely observed, and the vulnerability is not listed in the CISA KEV catalog. The required attacker state is authenticated administrator access to osctrl. Exploitation would proceed by creating or editing an environment with a malicious hostname value, embedding commands that execute immediately on endpoint enrollment. The consequence is remote code execution on every machine that enrolls with the affected environment, executing with elevated privileges and leaving no agent‑level audit trail.