The vulnerability is an OS command injection flaw in DSAI-Cline’s command auto‑approval module. The module validates input by string‑based parsing and blocks many dangerous operators, but it ignores raw newline characters. An attacker can embed a literal newline between an allowed command and additional malicious code, causing the PowerShell interpreter to treat them as separate commands. This results in the execution of arbitrary commands without any user interaction.

DSAI-Cline’s command auto‑approval module is affected. Specific vendor and product names are not listed, and no version details are provided. The flaw likely exists in all deployed versions of the module that use this validation approach.

The CVE does not have an EPSS score or KEV listing, but the description indicates a high severity Remote Code Execution risk. Attack likely requires remote access to the system that receives user-supplied commands, with most exploits exploiting the newline injection path. No official patch is referenced, so the likelihood of exploitation remains high until a fix is deployed.