Persister.validate_tgz builds a shell command "tar -tf #{tgz} 2>&1" where tgz includes a package name taken directly from package_meta['name'] inside the uploaded tarball. The command is executed via %x{}, which runs /bin/sh -c without escaping, leaving the name unescaped. Because this shell-out occurs before the Sequel validation of the package name, an attacker can provide a package_meta['name'] that injects shell metacharacters, enabling arbitrary command execution on the BOSH host. This flaw is a classic command injection (CWE-78) that jeopardizes confidentiality, integrity, and availability.

The vulnerability affects all BOSH versions prior to v282.1.12 (inclusive). The affected product is BOSH from the Cloud Foundry Foundation.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not reported, and the vulnerability is not listed in KEV, but that does not preclude exploitation. Based on the description, the likely attack vector is a remote upload of a crafted tarball that contains malicious package_meta['name'] values, enabling an attacker to run arbitrary commands on the BOSH controller over the network.