A critical OS command injection vulnerability in wg-easy allows authenticated users with specific permissions to achieve full root code execution on the host system.

This is an OS command injection flaw (CWE-78) where the application fails to neutralize newline characters in the client name field. An attacker with clients.create privileges can inject WireGuard PostUp directives, which are subsequently executed by the system with root privileges.

The ability for an authenticated user to achieve root code execution represents a total compromise of the host system. Given the CVSS score of 9.9, the risk is extreme, as an attacker can gain full control over the infrastructure, access sensitive WireGuard configurations, or pivot into the internal network.

Immediate Action: Upgrade to the latest version of wg-easy immediately to apply the patch that properly sanitizes user input.

Proactive Monitoring: Review application logs for unusual client creation requests or unexpected system command execution patterns.

Compensating Controls: Restrict access to the wg-easy management interface to trusted administrative users only and ensure the service is running with the least privilege necessary, although the vulnerability inherently targets root-level execution.

Public Exploit Available: Unknown

Organizations using wg-easy must treat this vulnerability with the highest urgency. The combination of command injection and root execution makes this a prime target for lateral movement within a network. Apply the latest vendor update as soon as it becomes available to remediate the underlying sanitization flaw.