The guardian language-system contains an OS command injection vulnerability identified as CVE-2026-34112. The id parameter from a GET request is directly concatenated into a PHP exec() call in speechmac.php without any sanitization or validation. This allows an unauthenticated attacker to append shell metacharacters and execute arbitrary operating system commands on the server hosting the application. The vulnerability is exploitable remotely without any user interaction or privileges. No vendor advisory or patch information is provided, and the remediation level is unknown.

An unauthenticated remote attacker can execute arbitrary OS commands on the server running the guardian language-system, potentially leading to full system compromise, data theft, or service disruption. The vulnerability does not require authentication or user interaction, increasing its severity. The CVSS 4.0 score of 9.3 reflects high exploitability and impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and implement web application firewall (WAF) rules to detect and block malicious input targeting the id parameter. Avoid exposing the vulnerable script to untrusted networks.