An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, a…

An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e affecting the traceroute module. The vulnerability occurs when shlex.Split parses user input without proper validation, allowing remote attackers to inject arbitrary flags through the q parameter. Attackers can exploit this by injecting flags like -w and -q to cause Denial of Service conditions. The attack vector enables exhaustion of system resources leading to service disruption. This vulnerability affects the bird-lg-go looking glass application used for network diagnostics.