Arcane versions up to 1.18.1 contain an OS command injection vulnerability (CWE-78) in the volume browsing functionality. The GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is incorporated into a shell command executed inside an Arcane helper container. While the path sanitizer blocks directory traversal sequences (../), it fails to neutralize Bourne-shell metacharacters such as $() and backticks. The use of strconv.Quote only escapes Go string characters, not shell substitution sequences, enabling command injection. Authenticated users with access to browse volumes can exploit this to run arbitrary commands inside the helper container, with command output reflected in HTTP 500 error responses.

An authenticated user with permission to browse volumes can execute arbitrary shell commands inside the Arcane helper container. This can lead to unauthorized command execution, potentially compromising the container environment. The reflected command output in error responses may also leak sensitive information. The CVSS 3.1 base score is 6.3, reflecting a medium severity impact with low attack complexity and requiring privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable endpoint to trusted users only and consider disabling volume browsing functionality if feasible. Monitor for updates from getarcaneapp regarding patches or official mitigations.