Vulnerability in Oracle Cloud Native Environment Command Line Interface v2.3.2 permits an unauthenticated attacker to inject a malicious environment variable that, when the CLI processes it, results in arbitrary code execution. The flaw arises from the program’s failure to validate or sanitize environment input before executing commands, a classic example of CWE‑94 (Code Injection).

Oracle Corporation provides the oracle-cloud-native environment command line interface. Only the v2.3.2 release is affected; no other versions or product lines are listed as impacted.

The CVSS score of 6.6 indicates moderate severity, and the EPSS score of < 1% shows a low likelihood of exploitation based on current data. The vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that the attack requires the attacker to supply a crafted environment variable to the CLI, so the most likely attack vector is a local or process‑level context rather than remote network exposure. Successful exploitation would allow execution of arbitrary code with the privileges of the user running the CLI.