The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 36.5%.
Command Injection
Setroubleshoot
Fedora
NVD
GitHub
Exploit-DB
CVSS 2.0
10.0
EPSS
36.5%
Threat
4.6