Executive brief
The Guardian language-system, a tool used for automatic translation and voice rendering, contains a critical security flaw. An attacker can remotely execute commands on the underlying server without needing a username or password. This could lead to a complete system takeover, theft of sensitive data, or disruption of translation services.
Technical details
An OS command injection vulnerability exists in the Guardian language-system due to improper neutralization of special elements in the 'id' GET parameter. In 'speechmac_text.php' at line 18, the application passes the unsanitized 'id' parameter directly into a PHP exec() call. A remote, unauthenticated attacker can exploit this by appending shell metacharacters (e.g., semicolons or backticks) to the URL parameter. This allows for arbitrary command execution with the privileges of the web server user. The vulnerability affects versions up to and including commit e42c395.
Affected products
- Guardian language-system up to commit e42c395
Timeline
- 2026-07-01: disclosed: Researcher disclosure by philopentest via GitHub Gist and VulnCheck.
- 2026-07-01: advisory: CVE-2026-34111 published.