IndigoSTAR Software perl2exe versions up to 30.10C contain an OS command injection vulnerability (CWE-78) that permits local authenticated users to execute arbitrary code. The flaw arises because attackers can manipulate the 0th argument of packed executables to execute a different executable than intended, effectively bypassing security controls and gaining unauthorized access. The CVSS 4.0 base score is 8.5, reflecting high impact and exploitability with local access and low attack complexity.

Successful exploitation allows local authenticated attackers to execute arbitrary malicious scripts or executables, potentially leading to unauthorized access and control over the affected system. The vulnerability can bypass existing restrictions on executable invocation, increasing the risk of privilege escalation or lateral movement within the environment.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and consider restricting local access to trusted users only until a fix is released. Avoid running untrusted packed executables and review local privilege assignments to minimize risk.