A flaw in the Cloud Task Scheduler component of HummerRisk allows attackers to manipulate the regionId argument within ResourceCreateService.java, resulting in command injection that can execute arbitrary operating‑system commands on the host running the service. Defined by CWE‑74 and CWE‑77, the vulnerability could compromise confidentiality, integrity, and availability of the affected system if successfully exploited.

The affected product is HummerRisk, versions up to and including 1.5.0. The flaw resides in the ResourceCreateService.java file of the Cloud Task Scheduler component, and no narrower sub‑product is defined; consequently, the entire HummerRisk application bundle is potentially impacted whenever the vulnerable version is in use.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % points to a very low exploitation likelihood at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the task‑scheduler endpoint and the ability to supply crafted regionId parameters, implying a remote exploit vector that can be launched over the network without local user interaction.