Apache Karaf's instance-management service (InstanceServiceImpl) builds command lines for launching child JVMs by string concatenation and executes them through /bin/sh or cscript. The javaOpts parameter, supplied by the caller, is inserted unquoted into this command string. If javaOpts contains shell metacharacters such as ;, |, `, or $(...), these are interpreted by the shell, resulting in arbitrary OS command execution under the Karaf process user. This vulnerability is exploitable via shell commands instance:create, instance:start, instance:restart, instance:change-opts, and equivalent InstanceMBean JMX operations. The affected versions are all Apache Karaf versions from 0 up to but not including 4.4.12.

An attacker able to supply crafted javaOpts values to the affected instance-management commands or JMX operations can execute arbitrary OS commands with the privileges of the Karaf process user. This can lead to unauthorized system access, data compromise, or further system compromise depending on the Karaf user's permissions.

No official patch or fix is explicitly stated in the provided data. Mitigation involves configuration changes: set karaf.secured.command.compulsory.roles=admin in etc/system.properties to enforce role-based access control, restrict access to instance:* commands and InstancesMBean via role assignments in etc/users.properties, and treat javaOpts input as untrusted unless it comes from fully trusted operators. These mitigations reduce the risk by limiting who can invoke the vulnerable commands and by controlling input trust.