An improper neutralization of argument delimiters in the nxchmod.sh script allows Local Users to inject arguments into executed commands. The vulnerability can be leveraged by a compromised or local user to execute arbitrary shell commands as the machine’s root user, compromising confidentiality, integrity, and availability of the affected system. The weakness is an Argument Injection flaw classified under CWE-88.

NoMachine software is affected, specifically all versions older than 9.5.7 and older than 8.23.2. Users running these releases are at risk until they upgrade to a non‑vulnerable version.

The CVSS score is 7.3, indicating high severity. EPSS information is currently unavailable, making it unclear how frequently this issue is being exploited in the wild, though the CVE is not listed in the CISA KEV catalog. The most likely attack vector is local, requiring an attacker to run code on the target machine, for example via scripts or local exploits. Once achieved, the attacker can gain full root privileges with the ability to modify system files, install malware, and maintain persistence.