The luci-app-tailscale-community component of openwrt contains an OS command injection vulnerability in the tailscale.do_login RPC method. Authenticated users can exploit this by providing crafted loginserver and loginserver_authkey parameters that are improperly quoted within a double-quoted shell command. This improper neutralization allows shell substitutions such as $() to be evaluated by the outer shell before argument processing, leading to arbitrary command execution with root privileges. The vulnerability affects versions <=0.11.1. No vendor advisory or patch information is currently provided.

An authenticated user can execute arbitrary commands as root on the affected system, potentially leading to full system compromise. This elevates the risk of unauthorized system control, data manipulation, or disruption of service. The CVSS 4.0 score of 7.7 reflects a high severity impact with network attack vector, low attack complexity, and no user interaction required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the tailscale.do_login RPC method to trusted users only and consider disabling the luci-app-tailscale-community application if feasible to reduce exposure.