CoolerControl Command Injection Vulnerability in Alert Names Allowing Root Code Execution

A command injection vulnerability has been identified in CoolerControl versions prior to 4.0.0. This issue allows authenticated attackers to execute arbitrary code as root by injecting bash commands into alert names. The vulnerability arises from insufficient sanitization of command inputs in the alert management feature of the application.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands with root privileges, allowing for potentially harmful actions to be performed on the system.

Remediation

Users can upgrade to CoolerControl version 4.0.0 or later, where this vulnerability has been addressed.