Rapid7 InsightConnect Sed Plugin for Linux contains an OS command injection flaw that allows an authenticated user to run arbitrary operating system commands by providing unsanitized input to the expression parameter. The vulnerability stems from insufficient input validation, enabling direct exploitation of the underlying shell. If leveraged, an attacker can gain full control of the host machine, compromising all data and services running on that system.

The issue affects the Rapid7 InsightConnect Sed Plugin on Linux installations. Any organization using this plugin with authenticated users should consider it vulnerable; specific version details are not listed in the CNA data.

With a CVSS score of 8.8 the flaw is considered high severity. The EPSS score is not available, so exploitation likelihood cannot be quantified, but the lack of a KEV listing indicates no publicly known exploits have been reported. The attack vector requires authentication to the plugin, suggesting that internal threat actors or compromised credential holders can exploit this weakness. The impact is remote code execution over the system running the plugin, potentially leading to data loss, persistence, or further foothold.