GHSA-c2p2-hgjg-9r3f: Crayfish Hypercube Remote Code Execution via X-Islandora-Args Header

Crayfish is the set of microservices behind Islandora digital repositories. Hypercube wraps Tesseract OCR and accepts extra command-line arguments through the X-Islandora-Args header. Those arguments reach the shell without neutralization.

An attacker who can reach a Hypercube instance over the network runs arbitrary commands on the server. No patched version was available when the advisory published. The maintainers' guidance is to keep the microservices behind a firewall. Crayfish 4.0.0 and earlier are affected.