Openchoreo (< 1.0.4, >= 1.1.0, < 1.1.4, >= 1.2.0-Rc.1, < 1.2.0-Rc.2)

Authenticated users can trigger OS command injection in OpenChoreo workflow templates by supplying crafted parameters that are insecurely interpolated into shell execution scripts.