The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.