An OS command injection flaw exists in Fortinet FortiSandbox 4.4.0 through 4.4.8, allowing an attacker to supply input that is not properly sanitized when passed to the operating system. This leads to execution of arbitrary commands or code on the sandbox host, giving the attacker control over the processing of data and potentially the underlying infrastructure.

The vulnerability affects FortiSandbox versions 4.4.0 to 4.4.8 and FortiSandbox PaaS releases 21.3.4055 through 23.4.4374. Users deploying any of these builds must ensure they apply the latest patches.

The flaw scores a CVSS base of 9.1, indicating a critical severity. Exploitation requires an attacker to send malicious input to an unsanitized interface; the attack vector is inferred to be external, such as a malicious file or request sent to the sandbox. No published exploits are known at the time of this advisory and the issue is not in the CISA KEV catalog, but the high score suggests a strong likelihood of future exploitation if left unpatched.