A remote attacker who can create a sketch in Flowsint can trigger the "org_to_asn" transformer on an organization node. The transformer incorrectly includes user-controlled data in a shell command, allowing the attacker to insert shell metacharacters that result in arbitrary OS command execution as the host process’s root user. This is a classic command injection flaw (CWE-78) that also provides a pathway to escape a restricted Docker container and compromise the entire host system.

The vulnerability exists in the open‑source Flowsint tool developed by reconurge. All releases prior to the commit that removed the vulnerable code (b52cbbb) are affected. No specific version numbers are listed in the advisory, so any installation that has not applied the fix is potentially exploitable.

The flaw receives a CVSS score of 9.3, indicating a high severity attack that can be performed remotely. The likely attack vector, inferred from the fact that the transformer is triggered through the web interface or API, is not explicitly stated in the advisory but can be reasonably assumed. No EPSS score is available, but the absence of a KEV listing does not diminish the risk; an attacker who can reach the Flowsint service can run commands with root privileges and potentially escape the Docker container. The attack would require that the vulnerable transformer be executed, making it a privilege escalation rather than a pure denial-of-service scenario.