The guardian language-system contains an OS command injection vulnerability (CVE-2026-34111) due to improper neutralization of special elements in the id GET parameter. Specifically, the id parameter is directly concatenated into a PHP exec() call in speechmac_text.php (line 18) without any sanitization or validation. This allows an unauthenticated remote attacker to append shell metacharacters and execute arbitrary operating system commands on the server hosting the application. The vulnerability is publicly known and assigned a critical CVSS 4.0 score of 9.3. No vendor advisory or patch information is currently available, and the affected versions are not explicitly stated.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary OS commands on the server, potentially leading to full system compromise, data theft, or disruption of service. The lack of authentication requirement and direct use of unsanitized input in a system command context significantly increases the risk and severity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the id parameter to prevent injection of shell metacharacters. Restricting or disabling the use of exec() calls with user input and applying web application firewalls to detect and block malicious payloads may provide temporary mitigation.