radare2 contains a command‑injection flaw in its PDB parser. The vulnerability is triggered when parsing symbol names that include newline characters, which are inserted into an unsanitized string used by the print_gvars() function. When a user runs the idp command against a malicious PDB file, the shell execution operator in radare executes the interpolated string, allowing an attacker to run arbitrary operating‑system commands. The flaw is categorized as OS Command Injection (CWE‑78).

The issue affects radare2 versions before 6.1.4 distributed by radareorg. Users running any prior release of radare2 are vulnerable. No other vendors or product branches are listed.

The flaw has a CVSS score of 8.4, indicating a high severity weakness. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the user to open a crafted PDB file and execute the idp command; thus the attack vector is file‑based and typically local. If an attacker can coerce a target into running radare2 on such a file, they can execute arbitrary system commands with the privileges of the radare2 process.