Apache CouchDB versions 3.5.2 and earlier contain a vulnerability where an unvalidated runtime configuration value allows a CouchDB server administrator to execute arbitrary shell commands as the operating system user running CouchDB. This issue is fixed in version 3.5.3.