The guardian language-system contains an OS command injection vulnerability (CVE-2026-34117) due to improper neutralization of special elements in the id GET parameter. Specifically, the parameter is directly passed into a PHP exec() call in text_to_subtitles.php (line 19) without any sanitization or validation. This allows an unauthenticated remote attacker to append shell metacharacters and execute arbitrary operating system commands on the server hosting the application. The vulnerability is publicly known with no authentication required and no vendor-provided patch or mitigation documented at this time.

An unauthenticated remote attacker can execute arbitrary OS commands on the server running the guardian language-system, potentially leading to full system compromise, data theft, or service disruption. The vulnerability has a critical severity with a CVSS 4.0 score of 9.3, reflecting its high exploitability and impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the id GET parameter to prevent injection of shell metacharacters. Restricting or disabling the use of exec() calls with user-supplied input can also mitigate risk. Monitor vendor channels for updates and patches.