The vulnerability allows an authenticated user to execute field injection against the device list endpoint, resulting in an invalid aggregation query that causes the API to return an uninformative HTTP 500 error. The crash is triggered by unvalidated BSON/SQL keys derived from the base64‑encoded filter and sort_by query parameters. The impact is a denial of service: the targeted endpoint becomes unusable until the service is restarted, and the error response offers no diagnostic information. The weakness is captured by CWE-20 (Improper Input Validation), CWE-1333 (Information Exposure through Log Injection), and CWE-943 (Unexpected Behavior).

ShellHub, version 0.24.1 and earlier, provided by shellhub-io. All authenticated API users can exploit the device list endpoint. The issue has been fixed in ShellHub 0.24.2 and later.

The CVSS score of 5.4 describes moderate severity. In the absence of an EPSS score, exploitation likelihood is unknown, and the vulnerability is not currently reported in CISA's KEV catalog. Exploitation requires knowledge of the API structure and an active authenticated session; any user with such access can repeatedly trigger the crash, potentially exhausting resources without rate limiting. The vulnerability is remotely exploitable, and the lack of rate limiting increases the risk of a volumetric DoS attack. The attacker does not gain elevated privileges or data exposure; the primary risk is service availability.