The vulnerability is a Windows‑only OS command injection in PinchTab v0.8.4, occurring in the orphaned Chrome cleanup routine. When an instance is stopped the cleanup routine builds a PowerShell command string that incorporates the profile path supplied by the attacker. The string interpolation escapes backslashes but leaves other PowerShell metacharacters unescaped, allowing an attacker with authenticated API access to craft a profile name that injects arbitrary PowerShell commands. Execution occurs under the Windows user account running PinchTab, so the attacker gains the privileges of that process but does not bypass host system boundaries.

Affected systems are installations of PinchTab, a standalone HTTP server that controls a Chrome browser, version 0.8.4 running on Windows. The fix is included in version 0.8.5. No other versions were explicitly listed as affected. The vulnerability does not affect non-Windows platforms.

The CVSS score of 6.7 represents a medium risk level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with administrative-equivalent permissions to the instance lifecycle API and a Windows host. The attacker must create an instance with a specially crafted profile name, then stop the instance to trigger the cleanup path. Because the conditions are specific, the likelihood is limited, but if achieved, the attacker can run arbitrary PowerShell commands with the PinchTab process user rights.