LemonLDAP::NG versions prior to 2.16.7 and from 2.17 up to but not including 2.21.3 contain an OS command injection vulnerability (CWE-78) in the Safe jail feature. The issue arises because the Safe jail does not properly localize the underscore character during rule evaluation, enabling an administrator who can modify rules to execute arbitrary OS commands on the server. This vulnerability requires high privileges (administrator access) and does not involve user interaction. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an administrator with rule editing privileges to execute arbitrary OS commands on the server hosting LemonLDAP::NG. This can lead to full compromise of the affected system, including unauthorized access to sensitive data, modification or destruction of data, and disruption of service. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict rule editing privileges to trusted administrators only and monitor for suspicious rule changes. Avoid running LemonLDAP::NG with unnecessary elevated privileges to limit potential impact.