Guardian language‑system builds an OS command string by concatenating the raw 'id' GET value into a PHP exec call. Because the input is used without escaping or validation, an attacker can inject shell metacharacters to execute arbitrary commands. The flaw is an OS Command Injection (CWE‑78) that allows a remote, unauthenticated user to gain code execution with the privileges of the web server process.

All installations of Guardian language‑system are potentially vulnerable as the advisory does not specify a version range. Any instance that includes the speech_text.php script and does not contain an updated, secured code path may be affected.

The CVSS score of 9.3 ranks this flaw as critical. The EPSS score of <1% indicates a low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. Nevertheless, the lack of authentication and the ability to execute arbitrary shell commands make this a high‑risk exposure that could easily lead to full system compromise.