The iSherlock-base-4.5 product by HGiga contains an OS command injection vulnerability (CWE-78) that permits unauthenticated local attackers to execute arbitrary OS commands on the server. The vulnerability has a CVSS 4.0 base score of 9.3, reflecting critical severity with high impact on confidentiality, integrity, and availability. The vulnerability is exploitable remotely without authentication or user interaction. No patch or official remediation level has been published by the vendor as of the current information.

Successful exploitation allows unauthenticated local attackers to execute arbitrary OS commands on the server hosting iSherlock-base-4.5. This can lead to full compromise of the affected system, including unauthorized data access, modification, or service disruption. The critical CVSS score reflects the potential for severe impact on system confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, organizations should monitor vendor communications for updates. Until a fix is available, restrict local access to trusted users only and consider applying any available workarounds recommended by the vendor once published.