This vulnerability (CVE-2026-41015) affects radare2, an open-source reverse engineering framework. When configured on UNIX systems without SSL, an attacker can perform OS command injection through a specially crafted PDB name passed to the rabin2 -PP command. The issue is due to improper neutralization of special elements used in OS commands (CWE-78). The vulnerable code was introduced after version 6.1.2 and fixed by commit 9236f44 prior to 6.1.3, existing for less than a week. No official patch or remediation guidance is currently documented.

Successful exploitation could allow an attacker with local access to execute arbitrary OS commands with the privileges of the radare2 process. The CVSS 3.1 base score is 7.4 (high), reflecting high impact on confidentiality, integrity, and availability. However, exploitation requires local access and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to radare2 versions including or after commit 9236f44 (post-6.1.3) once available. Until then, avoid running radare2 on UNIX without SSL or restrict access to trusted users only to reduce risk.