This vulnerability involves an OS command injection in the /stream-to-vlc Express route of hitarth-gg Zenshin prior to version 2.7.0. Remote attackers can supply malicious input through the url parameter, which is improperly sanitized, enabling arbitrary command execution on the affected system. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that the attack can be performed remotely with no privileges or user interaction and results in complete compromise of confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the vulnerable system, potentially leading to full system compromise including data theft, data modification, and service disruption. The critical CVSS score reflects the severe impact on all security properties (confidentiality, integrity, availability).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the /stream-to-vlc route or applying input validation and sanitization controls on the url parameter to mitigate exploitation risk.