The guardian language-system contains an OS command injection vulnerability (CVE-2026-34107) due to improper neutralization of special elements in the id GET parameter. This parameter is directly concatenated into a PHP exec() call in translate.php without any sanitization or validation. As a result, an unauthenticated attacker can append shell metacharacters to the id parameter and execute arbitrary operating system commands on the server hosting the application. This vulnerability does not require any privileges or user interaction to exploit, making it highly critical. No vendor advisory or patch information is provided at this time.

An unauthenticated remote attacker can execute arbitrary OS commands on the vulnerable server, potentially leading to full system compromise, data theft, or disruption of service. The vulnerability allows complete control over the server environment where the guardian language-system is deployed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable application and consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the id parameter. Avoid exposing the vulnerable endpoint to untrusted networks.