NexTOR_IP_CHANGER is a command‑line utility that rotates a Tor exit node by executing system commands. Versions before 2.0.0 build shell commands using `shell=True`, allowing executables found through the `PATH` environment to be invoked. This vulnerability constitutes a command‑execution flaw (CWE‑78) and can also lead to null pointer dereferences (CWE‑476) due to improper argument handling. An attacker who can influence the command‑execution environment can place a malicious binary early in the PATH and cause the tool to run that binary with the user’s privileges, effectively compromising the system.

The affected product is NexTOR_IP_CHANGER from vendor 0x5t4l1n. Versions prior to 2.0.0 are vulnerable; version 2.0.0 and later contain the fix.

The CVSS score of 7.8 represents a high‑risk vulnerability. No EPSS score is available, so exploitation probability cannot be quantified at this time, and the issue is not listed as a Known Exploited Vulnerability. The likely attack vector requires an attacker to control or manipulate the environment variables (particularly PATH) before the tool is executed, which is feasible if the tool is run in a shared or compromised environment. Once the environment is controlled, arbitrary command execution can occur at the privilege level of the running user.