An authenticated attacker can inject newline characters into the dns.hostRecord setting of Pi‑hole FTL, causing arbitrary dnsmasq configuration directives to be interpreted and ultimately executing shell commands on the host. This vulnerability is a command‑execution flaw combined with newline injection. If exploited, the attacker can gain full control of the underlying operating system, allowing data modification or destruction.

Pi‑hole FTL (pihole‑FTL) versions 6.0 through 6.5 are affected. Users running any of these releases are vulnerable until they upgrade to a patched version.

The CVSS score of 8.8 indicates high severity, and the flaw requires authentication to the API. Once credentials are obtained, the attacker can exploit the newline injection without further conditions. The absence of an EPSS score and the lack of listing in KEV suggest no documented active exploitation, but the combination of high severity and potential for full system compromise makes the risk critical, warranting immediate attention.