The vulnerability is an OS command injection flaw in the process_string action of the Rapid7 InsightConnect AWK Plugin. An attacker that can supply the text or expression parameters can cause the plugin to assemble and run an unsafe shell command, allowing the execution of arbitrary commands on the host. This provides remote code execution that could compromise the confidentiality, integrity, or availability of any services running on the affected system.

Rapid7 InsightConnect AWK Plugin installed on Linux systems. All current releases of the plugin that have not been updated with a vendor patch are considered vulnerable; no specific version bounds were supplied by the vendor.

The CVSS score of 7.7 indicates high severity, but no EPSS score is available, so the likelihood of exploitation is uncertain. The flaw is not included in CISA’s KEV catalog. Attackers can exploit the vulnerability by sending crafted payloads that trigger the process_string action, which will invoke the underlying shell without proper sanitization, permitting arbitrary command execution.