The guardian language-system contains an OS command injection vulnerability in subtitles.php at line 19. The id parameter from the GET request is used unsanitized in a PHP exec() call: exec("php jobs/subtitle_rendering.php " . $login_session . " " . $_GET['id'] . " ..."). Because there is no authentication required, an attacker can remotely inject shell metacharacters via the id parameter to execute arbitrary OS commands on the server. This vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity.

An unauthenticated remote attacker can execute arbitrary operating system commands on the server hosting the guardian language-system. This can lead to full system compromise, data theft, service disruption, or further network penetration. The vulnerability does not require any privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the id parameter to prevent command injection. Restricting or disabling the use of exec() with user-supplied input can mitigate exploitation risk. Monitor for updates from the vendor regarding an official patch.