The vulnerability arises from the grep() helper function in augment‑vir, which inserts caller‑controlled search patterns directly into a double‑quoted shell command without sanitization. When the constructed command is executed via spawn() with a bash shell, the shell evaluates embedded command substitution expressions, allowing an attacker to execute arbitrary OS commands as the Node.js process user. This results in unauthenticated local, and in some scenarios remote, code execution, compromising confidentiality, integrity and availability of the affected system. It is a classic instance of unsanitized command injection, classified as CWE‑78.

Affected products are the electrovir augment‑vir library. Versions older than 31.73.5 are vulnerable; the vulnerability has been fixed in version 31.73.5.

The CVSS score is 7.8, indicating a high severity risk. EPSS is not available and there is no KEV listing, but the flaw allows unauthenticated exploitation if untrusted data reaches the grep() function. Attacks can originate from local code that can materialize untrusted input, or from remote applications exposing the function. The lack of a public exploit does not diminish the risk, as the necessary primitives are straightforwardly available to an attacker with access to the input channel.