The vulnerability exists in the handling of the scriptPath parameter within Apache DolphinScheduler’s Alert Script plugin. The value supplied for scriptPath is passed directly to a /bin/sh -c command without proper neutralization of shell metacharacters. An attacker who can create a resource with a filename that contains shell command‑substitution syntax, such as $(...), can later provide that path to the /test‑send endpoint. When the plugin executes the script, the shell interprets the injected syntax and runs the attacker’s commands with the privileges of the DolphinScheduler service process, effectively granting remote code execution on the host machine.

Apache DolphinScheduler versions preceding 3.4.3 are vulnerable. Systems running 3.4.3 or later are not affected by this flaw.

The flaw is rated as a high‑severity command injection (CWE‑78) with a CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability. Exploitation requires an authenticated session, which is a common condition in operational deployments. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the combination of a high CVSS score and privileged execution scope warrants immediate attention.