This vulnerability exists in the /stream-to-vlc Express route of hitarth-gg Zenshin versions prior to 2.7.0. It permits remote attackers to inject and execute arbitrary OS commands through the url parameter, indicating insufficient input validation or sanitization. The vulnerability is classified as an OS command injection, which can lead to full system compromise if exploited. No CVSS score or vendor remediation details are provided, and no exploits are currently known in the wild.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected server, potentially leading to full system compromise, data theft, or disruption of service. The absence of known exploits suggests it may not yet be actively targeted, but the risk remains significant due to the nature of command injection vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable route, applying input validation or filtering on the url parameter, or upgrading to version 2.7.0 or later once released. Monitor vendor channels for updates regarding patches or official mitigations.