A flaw in Cockpit allows a remote attacker to inject shell metacharacters and command substitutions into unsanitized user‑controlled parameters within crafted links in the system logs user interface. This injection leads to arbitrary shell command execution on the host, giving the attacker full system compromise. The vulnerability is a command injection defect classified as CWE‑78.

Red Hat Enterprise Linux 7, 8, 9, and 10 contain the affected Cockpit component. All current installations of Cockpit on these platforms are vulnerable; no specific release is listed, so every bundled version remains at risk until a vendor fix is released.

The CVSS score of 8 indicates high severity. EPSS is not available, and the absence of any remediation suggests the flaw remains exploitable. Attackers must gain access to the Cockpit web UI, which typically listens on port 9090 based on Cockpit's default configuration; this inference is drawn because the CVE data does not explicitly state the port. The UI requires authentication. The likely attack vector is a web‑based exploitation of the Cockpit UI. If the service is exposed to untrusted networks, the vulnerability can be leveraged to execute arbitrary code, leading to complete system compromise.