The vulnerability is an OS command injection in the app.py component of openlabs docker-wkhtmltopdf-aas. A crafted POST request can cause arbitrary commands to run on the host, which allows an attacker to compromise confidentiality, integrity, and availability of the underlying system. This flaw is a classic command injection flaw (CWE‑78).

The affected product is the openlabs docker‑wkhtmltopdf‑aas Docker image; any instance running a version that contains app.py before commit 9f50579 is vulnerable. No other vendor or product names are specified beyond this repository, and the vulnerability spans all such releases.

The CVSS score is not listed; EPSS is not available and KEV does not list this vulnerability. An attacker only needs the ability to send a crafted POST request to the exposed service, which is typically reachable on a network interface. Because the flaw permits arbitrary command execution on the host, the risk is high. No public exploitation evidence is reported, but the potential impact warrants urgent remediation.