The guardian language-system contains an OS command injection vulnerability (CVE-2026-34114) due to improper neutralization of special elements in the id GET parameter. Specifically, translate_text.php line 18 executes a PHP exec() call incorporating the id parameter directly without sanitization: exec("php jobs/translate_text.php " . $login_session . " " . $_GET['id'] . " ..."). This allows an unauthenticated remote attacker to append shell metacharacters and execute arbitrary operating system commands on the server. The vulnerability is publicly known and rated critical with a CVSS 4.0 score of 9.3. No vendor patch or official fix has been disclosed as of the published date.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary OS commands on the affected server, potentially leading to full system compromise, data theft, or disruption of service. The lack of authentication requirement and direct execution of user input significantly increases the risk and impact severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the id parameter to prevent injection of shell metacharacters. Restricting or disabling the use of exec() calls with user-supplied input can also mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.