radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands…

radare2 versions prior to 6.1.4 contain a critical command injection vulnerability in the PDB parser's print_gvars() function. Attackers can craft malicious PDB files with newline characters in symbol names to inject arbitrary radare2 commands. The vulnerability occurs through unsanitized symbol name interpolation in the flag rename command. When users run the idp command against a malicious PDB file, the injected commands execute, potentially leading to arbitrary OS command execution through radare2's shell execution operator. This represents a significant security risk for users analyzing untrusted PDB files.