OS Command Injection vulnerability in the Rapid7 InsightConnect RPM Plugin allows an authenticated attacker to execute arbitrary OS commands on a Linux host. The flaw arises because the plugin constructs shell commands using the repo, key, or name parameters without proper input sanitization, leading to a CWE‑78 type injection. If exploited, an attacker can gain full control of the underlying system, compromising confidentiality, integrity, and availability.

Rapid7 InsightConnect RPM Plugin installed on Linux platforms. No specific version information is provided, but any instance that has the plugin enabled and permits authenticated access is potentially vulnerable.

The CVSS score of 6 indicates a medium severity vulnerability. There is no EPSS data to estimate exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must be authenticated to the InsightConnect platform and must know the vulnerable endpoint and parameter names. Though no public exploit is documented, the combination of authentication and command injection could allow a determined adversary to achieve remote code execution after discovery of the flaw.