An unprivileged local user can gain root privileges by crafting a nameserver value containing shell metacharacters when establishing a VPN connection through the NetworkManager-iodine plugin. The plugin processes the nameserver setting without proper validation, causing the injected commands to execute with elevated privileges before the application degrades its rights. This flaw is a classic operating‑system command injection (CWE‑78) and enables arbitrary code execution with root authority, thereby compromising confidentiality, integrity, and availability of the system.

The vulnerability affects GNOME’s NetworkManager-iodine VPN plugin and the accompanying iodine package on systems where they are installed. No specific version information is provided, so any release containing the unpatched nameserver handler is potentially vulnerable. The flaw is reachable only on platforms that use these packages to manage VPN connections.

With a CVSS score of 7.8, the vulnerability presents a high severity level. The EPSS score is not available, but the absence of a KEV listing indicates it has not been confirmed as a widespread exploit. Attackers must have local access to a machine running NetworkManager-iodine and the ability to create or modify VPN connections. Once the crafted nameserver entry is processed, the attacker can execute arbitrary shell commands as root, granting full system compromise. The vulnerability is exploitable without remote access and does not require elevated privileges to initiate the attack vector.