This vulnerability (CVE-2026-36576) affects the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579. It is an OS command injection flaw (CWE-78) that enables remote attackers to execute arbitrary commands by sending a specially crafted POST request. The vulnerability is remotely exploitable without authentication and requires low attack complexity. It results in complete compromise of the affected system's confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the vulnerable system, leading to full system compromise including data disclosure, modification, and denial of service. The CVSS score of 9.8 reflects critical impact across confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable service to trusted networks only and monitor for suspicious POST requests targeting the app.py component. Avoid exposing the service directly to untrusted networks.