Vulnerability in Oracle Cloud Native Environment Command Line Interface v2.3.2 allows an unauthenticated attacker to set a malicious environment variable that results in arbitrary code execution. The flaw is due to the CLI failing to validate or sanitize input from environment variables before executing commands, giving an attacker full control over the system that runs the binary.

Oracle Corporation distributes the oracle-cloud-native environment command line interface. The only affected release is version 2.3.2; no other vendors or product lines are listed as impacted.

The CVSS score of 6.6 indicates moderate severity, and the vulnerability is not listed in CISA KEV. Though the EPSS score is not available, the nature of the flaw permits exploitation by any user able to invoke the CLI with a crafted environment, potentially from local or remote contexts. An attacker could execute commands, exfiltrate data, or maintain persistence once the CLI is run.