The vulnerability permits arbitrary code execution on the host running JFrog CLI under specific configurations. It is a command injection weakness (CWE-88) that allows an attacker to execute shell commands when the CLI processes crafted input. This can lead to full system compromise, data exfiltration, or persistent attacker foothold.

The affected product is JFrog CLI. The vulnerability affects JFrog CLI v2.127.0 and earlier versions that support the vulnerable configuration. System administrators should verify installations of JFrog CLI v2.127.0 and ensure they are updated to v2.128.0 or later.

The CVSS score of 9.0 indicates critical severity. The EPSS score of 0.0034 indicates a very low probability of exploitation, yet the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local to the environment where JFrog CLI is invoked, requiring the attacker to trigger the CLI or provide crafted input. If the CLI is exposed to untrusted users or inputs, exploitation could be realized with minimal effort, resulting in complete compromise of the host.