Which versions of Guardian language-system are affected by CVE-2026-34111?

Guardian language-system is vulnerable to a critical remote code execution flaw (CVE-2026-34111, CVSS 9.3) that can be exploited by external attackers without credentials to seize control of affected…

How to fix or mitigate CVE-2026-34111?

Within 24 hours: Identify all systems running Guardian language-system and map network exposure; implement emergency firewall rules to restrict external access and segment affected systems from sensitive networks. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking shell metacharacters (|, ;, &, $, `, >, <, newlines) in the 'id' GET parameter; enable comprehensive request logging on speechmac_text.php; establish threat hunting for exploitation indicators. Within 30 days: Obtain vendor timeline for patched version and upgrade schedule; evaluate alternative products; complete risk-based remediation roadmap for any systems requiring continued operation.

Guardian language-system CVE-2026-34111

Q: What is the CVSS score of CVE-2026-34111?

CVE-2026-34111 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41069 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 disclosure@vulncheck.com

GHSA-7744-fxpq-9j2f

PHP Command Injection

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable exec() of attacker input gives AV:N/AC:L/PR:N/UI:N; arbitrary command execution yields full C/I/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:30 vuln.today

DescriptionCVE.org

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) without sanitization: exec(\"php jobs/speech_audio_mac_text.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

AnalysisAI

OS command injection in the Guardian language-system lets unauthenticated remote attackers run arbitrary shell commands by injecting metacharacters into the 'id' GET parameter, which speechmac_text.php concatenates directly into a PHP exec() call. The CVSS 4.0 base score is 9.3 (critical) with full compromise of confidentiality, integrity, and availability, and no authentication or user interaction is needed. No public exploit identified at time of analysis, though a referenced gist and the VulnCheck advisory may contain technical exploitation detail.

Technical ContextAI

The affected component is a PHP web application (Guardian language-system) that generates speech/audio artifacts by shelling out to helper scripts. In speechmac_text.php around line 18, user-controlled input is passed into exec("php jobs/speech_audio_mac_text.php ".$login_session." ".$_GET['id']." ..."), building an OS command string via string concatenation. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw: because the 'id' value is neither validated, escaped (e.g., escapeshellarg), nor bound to a numeric/whitelist form, shell metacharacters such as ;, |, &&, backticks, or $() break out of the intended argument and are interpreted by the underlying shell that PHP exec() invokes. No CPE strings were supplied by the sources, so exact affected package/version identifiers are not enumerated in NVD.

RemediationAI

No vendor-released patch identified at time of analysis, and no fix version was provided in the source data, so remediation must rely on compensating controls until the vendor ships a fix. The correct code-level fix is to stop concatenating the 'id' value into the shell string - pass it via escapeshellarg() or, better, cast/validate it to the strict numeric identifier the job script expects and reject anything else - but that requires a vendor or self-applied code change. As immediate controls: restrict network access to speechmac_text.php (and the broader admin/job interface) to trusted IPs or place it behind authentication/VPN, since the endpoint is unauthenticated by design; deploy a WAF rule to block shell metacharacters (; | & ` $ ( ) newline) in the 'id' parameter, accepting that regex-based filtering can be bypassed and is only a stopgap; and constrain the PHP/web service account with least privilege so successful injection cannot trivially escalate. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/guardian-language-system-unauthenticated-os-command-injection-via-id-parameter-in-speechmac-text-php) for vendor guidance and any subsequent patch release.