HCL BigFix RunBookAI version 11.2 contains a command injection vulnerability (CWE-77) due to improper input validation in a component handling command inputs. This flaw could allow an attacker with low privileges to execute arbitrary commands on the system without requiring user interaction, potentially compromising system confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.8 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by HCL as of the publication date.

Successful exploitation could lead to unauthorized command execution on the affected system, resulting in full compromise of confidentiality, integrity, and availability of the system running BigFix RunBookAI 11.2. This could allow attackers to execute arbitrary commands remotely with low complexity and without user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected system to trusted users only and monitor for unusual command execution activities. Avoid exposing the vulnerable component to untrusted networks or users. Follow vendor updates closely for any forthcoming patches or mitigations.