CVE-2026-25855 is a remote code execution vulnerability in OpenBullet2 (up to version 0.3.2) caused by improper neutralization of special elements in OS commands. Authenticated users can upload script files (.bat, .ps1, .sh) as proxy sources through the FileProxySource feature, which the server executes and returns output as proxy lines. This results in arbitrary command execution on the host system under the process user context.

Successful exploitation allows authenticated attackers to execute arbitrary commands on the host system running OpenBullet2, potentially leading to full system compromise, data theft, or disruption of services. The vulnerability has a high CVSS 4.0 score of 8.7, indicating significant impact with network attack vector, low attack complexity, and no user interaction required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users only and monitor for suspicious activity related to proxy source uploads. Avoid uploading untrusted script files as proxy sources.