The vulnerability in navi (<=2.24.0) involves improper neutralization of special elements used in OS commands. Specifically, cheatsheet variable values are not correctly escaped before being substituted into shell commands. An attacker can exploit this by crafting file names containing shell metacharacters in suggestion command directories, enabling execution of arbitrary commands under the victim's privileges.

Successful exploitation can lead to arbitrary command execution with the privileges of the victim user. This can result in unauthorized actions on the affected system, depending on the victim's permissions. The CVSS 4.0 score of 7.3 indicates a high severity vulnerability with local attack vector, high attack complexity, and requiring user interaction and privileges not required.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using untrusted cheatsheet files or suggestion command directories that could contain malicious file names. Exercise caution when handling input that may be substituted into shell commands.