LawnchairLauncher’s lawnchair app contained a command injection vulnerability (CWE-77) in the release_update.yml workflow dispatch input. This flaw allowed an attacker with limited privileges to execute arbitrary code by injecting special command elements. The vulnerability was fixed by commit fcba413f55dd47f8a3921445252849126c6266b2. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, but high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary commands within the context of the workflow, potentially leading to full compromise of the affected system or environment. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, there are no reports of active exploitation in the wild at this time.

The vulnerability is patched in commit fcba413f55dd47f8a3921445252849126c6266b2. Users and administrators should update to versions including this commit or later to remediate the issue. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the vendor commit reference. No additional mitigation steps are indicated.