The vulnerability allows an attacker to inject arbitrary shell commands through the Async Query API of Apache Kylin. The backend API incorporates job configuration parameters directly into an operating‑system command line without adequate sanitization, giving the attacker the ability to run arbitrary commands. If the injection succeeds, the attacker can achieve full system compromise, enabling data theft, service disruption, or the deployment of additional malware. The weakness is classified as CWE‑78, representing improper neutralization of special elements used in a command.

Apache Kylin versions 4.x through 5.0.3 are affected. All installations running these versions are susceptible unless upgraded. The fixed version is 5.0.4, which removes the command‑injection flaw.

The CVSS score of 8.8 indicates high severity, while the EPSS score of 1% suggests a measurable but limited likelihood of exploitation at present. The attack vector involves the Async Query endpoint, where crafted job configuration parameters can be injected. The lack of a listing in the CISA KEV catalog indicates that no public exploitation has been documented yet, yet the high potential impact warrants proactive mitigation.