The vulnerability in KubePlus 4.14's kubeconfiggenerator component arises from unsafe use of subprocess.Popen() with shell=True, where the chartName parameter from user input is directly concatenated into the command string without validation. This leads to command injection via the `/registercrd` endpoint, enabling an attacker to execute arbitrary shell commands on the affected system.

Successful exploitation allows an attacker to execute arbitrary shell commands on the system running the vulnerable KubePlus component, potentially leading to full system compromise depending on the privileges of the process. No specific CVSS score or exploit details are available. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, avoid exposing the `/registercrd` endpoint to untrusted users and consider implementing input validation or disabling the vulnerable component if possible.