A critical command injection vulnerability in coolercontrold allows authenticated users to achieve root-level code execution, posing a severe risk to system integrity.

This is an OS Command Injection (CWE-78) vulnerability occurring within the alert processing functionality. Authenticated attackers with high privileges can inject malicious bash commands into alert names, which are then executed by the system with root-level permissions.

The ability for an attacker to execute arbitrary commands as root grants them total control over the host system. Successful exploitation could lead to full system compromise, unauthorized data access, and persistent backdoors. Given the CVSS score of 8.2, this vulnerability is classified as high severity, reflecting the significant impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade to version 4.0.0 or later to apply the necessary input sanitization fixes provided by the vendor.

Proactive Monitoring: Review system access logs for suspicious alert configurations and monitor for unexpected process execution triggered by the coolercontrold service.

Compensating Controls: Restrict administrative access to the coolercontrold configuration interface to only trusted users, and implement host-based intrusion detection systems to monitor for unauthorized command execution.

Public Exploit Available: No (exploit_available: false).

Given the potential for complete system takeover, organizations utilizing coolercontrold must prioritize the update to version 4.0.0. The requirement for high privileges does not reduce the urgency of this patch, as an attacker who has already gained administrative access to the management interface can escalate their control to the underlying operating system.