Guardian language‑system is vulnerable to unauthenticated OS command injection because the id GET parameter is concatenated directly into a PHP exec() call in text_to_subtitles.php without any sanitization. This flaw allows an attacker to append shell metacharacters to the id value, such as ;rm -rf /, so that the exec() invocation runs arbitrary operating‑system commands with the privileges of the web worker process. The potential impact is full system compromise, allowing the attacker to exfiltrate data, modify system configuration, or cause denial of service through destructive commands.

Any deployment of Guardian language‑system that contains the vulnerable text_to_subtitles.php snippet is affected. The CVE entry does not specify particular release numbers, so all installations that include the exec() call with an unsanitized id parameter remain at risk. Administrators should verify that their version contains the vulnerable code and check for any available vendor updates.

With a CVSS score of 9.3, this issue is classified as critical. The EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an unauthenticated remote attacker can trigger the flaw by sending a crafted GET request such as /text_to_subtitles.php?id=123;rm -rf /, which the exec() call will execute on the server. Because the flaw requires no authentication, the attack surface is large and the consequences severe.