Guardian language-system exposes a severe OS command injection vulnerability in the transcribe.php script. The application concatenates the id GET parameter directly into a PHP exec() call without sanitization, a classic CWE‑78 flaw that allows an attacker to inject shell metacharacters. Because no authentication is required, a remote prepared request can trigger arbitrary command execution on the underlying server, fully compromising confidentiality, integrity, and availability.

All installations of the Guardian language‑system that contain transcribe.php are potentially affected. Vendor data does not specify vulnerable versions; consequently any instance that has not applied a fix is assumed vulnerable.

The CVSS score of 9.3 signifies critical severity, and the EPSS score of less than 1% indicates that while the likelihood is low, it remains non‑zero. Being unauthenticated and remote, exploitation requires only a crafted HTTP GET request to the vulnerable endpoint, thereby enabling attackers to run arbitrary OS commands. The vulnerability is not listed in the CISA KEV catalog, but its nature warrants high‑priority remediation.