The vulnerability is an OS command injection flaw in the My Computer component of Pardus OS, allowing an attacker to supply unsanitized input that is directly incorporated into an operating‑system command. The improper neutralization of special elements means that an attacker could execute arbitrary commands, leading to remote code execution, full system compromise, and data exfiltration. This weakness is classified as CWE‑78, indicating failures in input validation for OS command execution.

The flaw affects Pardus OS My Computer from version 0.7.5 and earlier; the issue is resolved in 0.8.0 and later releases. The affected vendor is TUBITAK BILGEM Software Technologies Research Institute, which maintains the Pardus OS distribution.

The CVSS score of 8.8 indicates a high severity vulnerability and the lack of an EPSS score suggests that specific exploitation data is not publicly available yet. The flaw is not listed in the CISA KEV catalog, but the potential for arbitrary command execution makes it a high‑risk vulnerability. The likely attack vector is local or remote input to the My Computer interface; an attacker with the ability to influence the affected parameter could trigger the injection. No specific mitigation is reported, so the risk remains until a patch is applied.