Rapid7 InsightConnect Finger Plugin on Linux contains an OS Command Injection flaw due to inadequate input validation of the user and host parameters that are inserted into a shell command. An authenticated attacker can supply crafted values to these parameters and execute arbitrary operating‑system commands, which could allow full control of the host on which the plugin is running, leading to data theft, system compromise, or further lateral movement.

The vulnerability affects the Rapid7 InsightConnect Finger Plugin on Linux installations. No specific product version information is supplied in the advisory, so all instances of the plugin should be considered potentially vulnerable until a patch is applied.

The CVSS score of 6.0 indicates a moderate severity rating. The EPSS score is not available, and the issue is not currently listed in CISA’s Known Exploited Vulnerabilities catalog. The attack requires authentication to the InsightConnect environment, suggesting an insider or compromised credential scenario. Because the vulnerability provides a straightforward injection point, exploitation could be achieved with minimal effort once access is obtained, although the exact probability of exploitation cannot be quantified due to the missing EPSS data.