CVE-2026-25855 is an OS command injection vulnerability in openbullet2 (up to version 0.3.2) that permits authenticated users to upload script files through the FileProxySource proxy loading feature. These scripts (.bat, .ps1, .sh) are executed on the host system, allowing arbitrary command execution with the permissions of the running process. The vulnerability arises from improper neutralization of special elements in user-supplied input used in OS commands. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the host system running openbullet2, potentially leading to full system compromise depending on the privileges of the process user. This can result in unauthorized access, data manipulation, or disruption of service. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users only and monitor for suspicious activity related to proxy source uploads. Avoid uploading untrusted script files as proxy sources.