A command injection vulnerability exists in the alert generation component of CoolerControl’s coolercontrold daemon in all releases older than 4.0.0. The flaw allows an authenticated attacker to embed arbitrary bash commands in alert names, which the service executes with root privileges. This results in remote code execution and full system compromise. The weakness stems from improper sanitization of user input before concatenating it into an OS command, corresponding to a CWE‑78 flaw.

The affected product is CoolerControl’s coolercontrold daemon. All versions older than 4.0.0 are vulnerable regardless of operating system or deployment configuration. Any environment that allows authenticated users to create or edit alerts is exposed.

With a CVSS score of 8.2, the vulnerability is considered high severity. The EPSS score is not available, but the requirement of authentication—common in many deployments—implies a non-negligible exploitation probability. The flaw is not listed in the CISA KEV catalog yet; however, the potential for full root compromise warrants immediate action. An attacker who can authenticate to the coolercontrold API can craft an alert name containing malicious shell syntax; when the daemon processes the alert, the embedded command runs as root, enabling arbitrary code execution.