The guardian language-system contains an OS command injection vulnerability (CVE-2026-34107) due to improper neutralization of special elements in the id GET parameter. Specifically, translate.php line 14 executes a PHP exec() call that concatenates the id parameter directly without sanitization: exec("php jobs/translate.php " . $login_session . " " . $_GET['id'] . ...). This allows an unauthenticated remote attacker to append shell metacharacters and execute arbitrary OS commands on the server. The vulnerability is publicly known and rated critical with a CVSS 4.0 score of 9.3. There is no vendor-provided patch or remediation information available at this time.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary operating system commands on the server hosting the guardian language-system. This can lead to full system compromise, data theft, service disruption, or further attacks. The vulnerability does not require any privileges or user interaction to exploit, increasing its severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable translate.php functionality, implement web application firewalls to detect and block suspicious command injection attempts, and apply strict input validation or sanitization on the id parameter if possible.