An unauthenticated remote code execution vulnerability in OpenChamber allows attackers to execute arbitrary system commands with the privileges of the application user.

The application fails to sanitize inputs provided to the /api/fs/exec endpoint, passing them directly to a Node.js spawn function. Furthermore, the authentication middleware is bypassed if the UI_PASSWORD is not configured, which is the default state in many deployments.

With a CVSS score of 9.8, this vulnerability poses an extreme risk. An attacker can execute arbitrary OS commands, leading to full server compromise, data theft, or the establishment of persistent access within the target network.

Immediate Action: Update OpenChamber to the latest version. Ensure that UI_PASSWORD is set and configured to enforce authentication requirements.

Proactive Monitoring: Monitor server logs for unexpected process execution or suspicious commands originating from the web application process.

Compensating Controls: Place the OpenChamber instance behind a secure reverse proxy or VPN to prevent public access to the API endpoints and implement WAF rules to block malicious shell command patterns.

Public Exploit Available: No

This vulnerability represents a critical security failure in default deployments. Administrators must apply the patch immediately and verify that strong authentication is enabled for the web interface to prevent unauthorized access and command execution.