The flaw resides in the CommandUtils.commonExecCmdWithResult method within the CloudTaskService.java component of HummerRisk, affecting all releases up to 1.5.0. An attacker can exploit the fileName parameter to inject arbitrary operating‑system commands, permitting remote execution of code on the host machine. This vulnerability embodies CWE‑74 (Improper Validation of Quoted Strings) and CWE‑77 (OS Command Injection). The impact is the loss of confidentiality, integrity, and availability for the affected system as an attacker can run any command with the privileges of the service.

All installations of HummerRisk produced by the vendor HummerRisk, specifically versions up to and including 1.5.0, are impacted. No further version details are supplied.

The CVSS score of 5.3 indicates a medium severity risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Remote exploitation is possible, typically via exposed API endpoints or interfaces that allow manipulation of the fileName argument. In the absence of an official patch, the risk remains medium but can become higher if the service is exposed to untrusted users.