LawnchairLauncher’s lawnchair app contained a command injection vulnerability (CWE-77) in its release_update.yml workflow dispatch input. This improper neutralization of special elements allowed an attacker with limited privileges to execute arbitrary code. The issue was fixed by commit fcba413f55dd47f8a3921445252849126c6266b2. The vulnerability affects versions prior to this commit. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system, potentially leading to full compromise of the environment where the workflow runs. This can impact confidentiality, integrity, and availability of the system. However, there are no reports of exploitation in the wild at this time.

A fix is available and has been applied in commit fcba413f55dd47f8a3921445252849126c6266b2. Users should update to the version including this commit to remediate the vulnerability. Since this is not a cloud service, remediation requires updating the affected software to the patched version.