The vulnerability stems from the library’s handling of user-controlled strings passed to the shell execution function. When these strings contain pipe characters, the command is split and each segment is executed, allowing an attacker to inject arbitrary commands. In monitoring plugins, user-supplied arguments such as the --repo option constructed a restic command that could embed a malicious pipe-delimited payload. If the monitoring process runs with elevated privileges, the injected command is executed as root, giving full system control to the attacker.

Applications built with Linuxfabrik lib or its monitoring plugins are affected. Versions of linuxfabrik-lib prior to 5.0.0 and Linuxfabrik Monitoring Plugins prior to 6.0.0 contain the flaw. Within these releases, any plugin that forwards user input to lib.shell.shell_exec() without sanitization is vulnerable.

The CVSS score of 7.8 indicates a high severity impact. The EPSS score is unavailable, but the lack of a KEV listing does not diminish the risk, as exploitation requires only a compromised monitoring account with elevated privileges. Attackers could exploit the flaw by supplying a crafted input to a vulnerable plugin, gaining root privileges on the host.