Improper neutralization of special elements used in a command enables an unauthorized attacker to inject commands into Azure Cloud Shell. This command injection flaw, identified as CWE-77, can allow the attacker to execute arbitrary shell commands that may be used to spoof network traffic, thereby compromising the integrity and authenticity of communications.

The vulnerability affects Microsoft Azure Cloud Shell. No specific version information is provided, so all iterations of Azure Cloud Shell that have not been updated with Microsoft’s latest security patch are potentially vulnerable.

The CVSS score of 9.6 signals a high severity risk, indicating that successful exploitation would provide the attacker with significant control over the affected system. While the EPSS score is not available, the absence of a KEV listing suggests no publicly known exploits yet, but the high intrinsic severity warrants immediate attention. The injection can be performed remotely over the network by any entity able to interact with the Cloud Shell, making the attack vector likely remote attacker via unsecured input.