The vulnerability resides in the password reset functionality of Squirro Cognitive Search versions prior to 3.14.2. A crafted payload sent to the password reset endpoint allows a remote attacker to execute arbitrary code on the host system, leading to full compromise and data exfiltration. The flaw results from inadequate input validation, exposing the system to command injection or code execution attacks.

Squirro Cognitive Search software, specifically any deployment running a version earlier than 3.14.2.

The CVSS score is not provided, but the ability to run arbitrary code indicates a high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, so the current exploitation probability is unknown. Attackers would need network access to the password reset endpoint, but the vector is likely remote over HTTP/HTTPS. The exploit could be automated given the lack of authentication requirements for the reset request.