A command injection vulnerability in radare2 allows an attacker to execute arbitrary shell commands by providing a malicious ELF binary for analysis, posing a significant risk to the host system.

This is an OS Command Injection (CWE-78) flaw triggered when radare2 processes a crafted ELF binary using the aaa and afsvj commands. The vulnerability stems from unsanitized parameter interpolation within the pfq command string, which allows an unauthenticated attacker to execute arbitrary commands if they can convince a user to analyze a malicious file.

Successful exploitation results in arbitrary code execution on the system running radare2, potentially leading to a full compromise of the local environment. Given the CVSS score of 7.8, this represents a high-severity risk, particularly for security researchers and reverse engineers who frequently handle untrusted binary samples. Unauthorized access to the host machine could result in data theft, lateral movement within the network, or persistent backdoor installation.

Immediate Action: Update radare2 to a version containing the fix implemented in commit bc5a89033db3ecb5b1f7bf681fc6ba4dcfc14683 or later.

Proactive Monitoring: Monitor system logs for unexpected shell process spawns originating from the radare2 execution environment.

Compensating Controls: Execute analysis of unknown or untrusted binaries within an isolated, non-persistent sandbox or virtual machine to contain potential command injection attempts.

Public Exploit Available: No

Users of radare2 should prioritize upgrading their installations to the patched version as soon as possible to eliminate the command injection vector. Until an update is applied, exercise extreme caution when performing automated analysis on binaries from unverified or untrusted sources, as the simple act of invoking analysis commands on a malicious file can trigger the exploit.