An OS command injection vulnerability in truelockmc Streambert allows local authenticated users to execute arbitrary commands with the privileges of the application.

The application fails to properly sanitize input, leading to OS command injection (CWE-78) and general input validation failures (CWE-20) when processing user-provided data.

This vulnerability carries a CVSS score of 8.8, reflecting the potential for full system compromise if an attacker successfully injects and executes malicious commands. This can lead to unauthorized data access, persistence on the host machine, or the disruption of critical services.

Immediate Action: Upgrade to Streambert version 2.6.0 or higher, which includes the necessary patches to neutralize command injection vectors.

Proactive Monitoring: Monitor for the spawning of unusual child processes or unauthorized shell execution attempts initiated by the Streambert application.

Compensating Controls: Restrict the application's environment using OS-level sandboxing or containerization to prevent the application from executing arbitrary system binaries.

Public Exploit Available: No

The risk of command injection requires immediate attention to prevent unauthorized code execution. Administrators should verify that all instances of Streambert are updated to version 2.6.0 to ensure the application environment is adequately secured.