The guardian language-system contains an OS command injection vulnerability (CVE-2026-34110) due to improper neutralization of special elements in the id GET parameter. Specifically, the id parameter is directly concatenated into a PHP exec() function call in complex_start.php without any sanitization or validation. This allows an unauthenticated remote attacker to append shell metacharacters and execute arbitrary operating system commands on the server hosting the application. The vulnerability is exploitable remotely without any privileges or user interaction. No vendor advisory or patch information is provided at this time.

An unauthenticated remote attacker can execute arbitrary OS commands on the server running the guardian language-system. This can lead to full system compromise, data theft, service disruption, or further attacks within the environment. The vulnerability is critical due to the lack of authentication and the ability to execute commands with the privileges of the web server process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the id parameter to prevent injection of shell metacharacters. Restricting or disabling the use of exec() calls with user-controlled input can also mitigate the risk. Monitor for updates from the vendor regarding patches or official mitigations.