radare2 before version 6.1.4 contains an OS command injection vulnerability (CWE-78) in the PDB parser's print_gvars() function. Attackers can craft malicious PDB files with newline characters in symbol names to inject arbitrary radare2 commands via unsanitized interpolation in the flag rename command. When a user executes the idp command on such a file, these injected commands run, resulting in arbitrary OS command execution through radare2's shell execution operator. This vulnerability requires local access to the malicious file and user interaction to trigger.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the system running radare2 by leveraging crafted PDB files. This can lead to unauthorized code execution and potential system compromise. The attack requires the victim to run the idp command on the malicious file, and no privilege is required to trigger the vulnerability. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening untrusted or suspicious PDB files with radare2 and refrain from running the idp command on such files. Monitoring vendor channels for updates and applying patches promptly once released is recommended.