This vulnerability in radare2 allows an attacker to embed malicious shell commands within DWARF debugging information in ELF binaries, specifically in the DW_TAG_formal_parameter names. When radare2 analyzes such a binary using the aaa command and then runs afsvj, the embedded commands are executed because the parameter interpolation in the pfq command string is not properly sanitized. This leads to arbitrary OS command execution with the privileges of the user running radare2. The vulnerability affects versions prior to commit bc5a890 and has a CVSS 4.0 score of 8.5, indicating high severity. No patch or official remediation level has been published yet.

Successful exploitation results in arbitrary shell command execution on the system running radare2, potentially allowing attackers to execute commands with the user's privileges. This could lead to system compromise or unauthorized actions depending on the environment and user permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid analyzing untrusted or suspicious ELF binaries with radare2 commands aaa and afsvj. Consider running radare2 in a restricted or sandboxed environment to limit potential impact.