An authenticated command injection vulnerability in NVIDIA LXD allows attackers to execute arbitrary configuration directives, posing a high risk of system compromise.

The software suffers from an OS command injection flaw (CWE-78) where special elements in NVIDIA instance configuration are not properly neutralized, allowing an authenticated attacker to execute arbitrary commands.

This vulnerability carries a CVSS score of 8.7, indicating high severity. Successful exploitation permits an attacker to escape container boundaries or gain elevated control over the host system, potentially leading to total system compromise, data theft, and unauthorized access to sensitive infrastructure.

Immediate Action: Upgrade to LXD version 4.0.12, 5.0.8, 5.21.6, or later, as provided by the vendor.

Proactive Monitoring: Inspect system logs for unusual configuration changes and monitor for unexpected process execution originating from the LXD service.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users capable of modifying instance configurations.

Public Exploit Available: Unknown

Given the high CVSS score and the presence of a proof-of-concept, organizations should prioritize patching LXD instances immediately. Applying the vendor-provided updates is the only definitive way to neutralize the command injection vector.