The vulnerability occurs in the CommandUtils.commonExecCmdWithResult of the CloudTaskService.java component used by the Cloud Task Dry. By supplying a crafted fileName argument, an attacker can inject arbitrary operating‑system commands into the underlying command‑execution routine. This leads to remote code execution and can compromise the confidentiality, integrity, and availability of the host system. The weakness corresponds to improper validation of quoted strings (CWE-74) and OS command injection (CWE-77).

All installations of HummerRisk, version 1.5.0 and earlier, are vulnerable. In particular, the Cloud Task Dry-run component that contains CloudTaskService.java is affected. No additional version details are disclosed.

The CVSS score of 5.3 indicates a medium severity vulnerability, while the EPSS score of 28% indicates a moderate likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The description explicitly states that remote exploitation is possible, implying that the affected interface can be accessed over the network. This inference is drawn from the phrase ’Remote exploitation of the attack is possible’ rather than from concrete evidence of an exposed API. If the Cloud Task Dry-run functionality is accessible to untrusted users, the attacker can trigger execution, potentially taking control of the host or causing a denial of service.