This vulnerability (CVE-2026-8664) affects the Rapid7 InsightConnect Finger Plugin on Linux platforms. It arises from improper neutralization of special elements in OS commands (CWE-78), specifically in the handling of the user or host parameters. Authenticated attackers can leverage this flaw to inject and execute arbitrary OS commands because the plugin does not sufficiently validate or sanitize input before incorporating it into shell commands. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact.

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands on the affected system, potentially leading to unauthorized modification of data (high integrity impact) and limited confidentiality and availability impacts. This could compromise the affected system's integrity and potentially disrupt normal operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the InsightConnect Finger Plugin to trusted users only and monitor for unusual activity related to command execution. Avoid passing untrusted input to the user or host parameters. Follow Rapid7's advisories for updates.