The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force an operator's browser to execute arbitrary management commands via cross-site request forgery, including control.py --wipe, which permanently deletes all captured data.
Unauthenticated cross-site request forgery in the kiosk /script_call endpoint allows arbitrary management-command execution.
cve.org record · GitHub Security Advisory GHSA-w8gq-4v5x-xrrm