An OS command injection flaw in wg-easy 15.3.0 allows an attacker with the clients.create permission to inject newline‑delimited WireGuard PostUp directives into the client name field. The name is written directly into the WireGuard configuration file without neutralizing newline characters, so injectable directives are executed by wg-quick with root privileges, giving the attacker arbitrary root command execution on the host system. The weakness corresponds to CWE-78, an input validation flaw that leads to command execution.

The vulnerability is confined to wg‑easy version 15.3.0. Any installation of that exact release where users possess the clients.create privilege is at risk. Earlier or later releases are not affected according to the advisory. No other vendors or products are impacted.

The CVSS score of 9.9 classifies the flaw as critical, and the EPSS score of 2% suggests a non‑zero but low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the client‑creation API or web interface exposed by wg‑easy, which requires the attacker to compromise a user with clients.create rights. Once this privilege is obtained, the attacker can inject a newline in the client name and gain full root code execution on the host. The overall risk is high, driven by the severe impact and the need for administrative permission, which may be available through credential compromise or other vulnerabilities.