Executive brief
The Guardian language-system, a tool used for automatic translation and subtitling, contains a critical security flaw. An attacker can remotely execute commands on the underlying server without needing a username or password. This could lead to a complete system takeover, theft of sensitive data, or disruption of translation services.
Technical details
An OS command injection vulnerability exists in Guardian language-system due to improper sanitization of the 'id' GET parameter in 'speech.php'. The application passes this parameter directly into a PHP 'exec()' call when invoking 'jobs/speech_audio.php'. Because no authentication is required to access this endpoint, a remote attacker can append shell metacharacters (e.g., semicolons or backticks) to the 'id' parameter to execute arbitrary commands with the privileges of the web server user. The vulnerability is present in versions up to and including commit e42c395.
Affected products
- Guardian language-system <= commit e42c395ec4b03fe62973a669c9209a673838b8a4
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory