The vertex-app vertex product versions up to 2026.02.12 contain an OS command injection vulnerability in the Log Viewer Endpoint component, specifically in the app/model/LogMod.js file. The vulnerability results from improper handling of the req.query parameter, enabling remote attackers to inject and execute arbitrary operating system commands. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. A patch identified by commit 805d82e7100d49b79b3beb1b9420e8e458987198 is available to fix this issue.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized system control or data compromise. The medium CVSS score reflects a moderate risk due to the ease of remote exploitation without user interaction and low complexity. No known active exploits have been reported in the wild so far.

A patch identified by commit 805d82e7100d49b79b3beb1b9420e8e458987198 is available and should be applied promptly to remediate this vulnerability. Since the vendor advisory or official remediation level is not explicitly provided, it is recommended to verify and apply the patch from the vendor or project repository to resolve the issue. No alternative mitigations or vendor statements indicating no action required are available.