The vulnerability is a classic OS command injection flaw that appears when the Translate action in Rapid7 InsightConnect Translate Plugin constructs a shell command without proper sanitization of the text or expression parameters. An attacker who can reach the action endpoint can supply specially crafted input that is executed verbatim by the underlying operating system, allowing the attacker to run any commands they choose. This leads to a total breakdown of confidentiality, integrity, and availability for the affected system.

The affected component is the Translate plugin for Rapid7 InsightConnect, which runs on Linux platforms. No specific version information is provided, so all installations of this plugin that contain the described input‑handling logic are potentially vulnerable.

The CVSS score of 7.7 indicates that the flaw is considered a high‑severity vulnerability. The EPSS score is not available, and the issue is not currently listed in the CISA Known Exploited Vulnerabilities catalog, so the exploitation likelihood is unclear, but the lack of input validation makes exploitation straightforward if the action can be invoked remotely.