An OS command injection flaw in radare2 presents a high security risk, potentially allowing local attackers to achieve full system compromise.

This is an OS command injection vulnerability (CWE-78) occurring within the rabin2 utility when handling PDB names. The vulnerability is exploitable by an unauthenticated local user when the software is configured on UNIX systems without SSL.

The vulnerability carries a CVSS score of 7.4, indicating high severity. Successful exploitation permits an attacker to execute arbitrary commands with the privileges of the user running the radare2 tool, leading to full system compromise, unauthorized data access, or the installation of persistent malicious software.

Immediate Action: Update your radare2 installation to commit 9236f44a28812fe911814e1b3a7bcf1e4de5d3c2 or later to include the necessary security fix.

Proactive Monitoring: Monitor system logs for unexpected process spawns or abnormal command-line arguments involving the rabin2 utility.

Compensating Controls: Ensure that radare2 is executed within a restricted environment or container with minimal privileges to limit the potential impact of a successful injection.

Public Exploit Available: No

Given the potential for complete system compromise, organizations utilizing radare2 must prioritize updating their software to the patched version. Although the exploit requires local access, the risk of arbitrary code execution necessitates immediate action to prevent unauthorized system control.