vulnerability in Cockpit’s system logs UI code (pkg/systemd/logsJournal.jsx, loadServiceFilters() path). The flaw is caused by building a command from an array, joining it into a single string with only space escaping, and then executing it via /bin/bash -ec. User-controlled parameters from the logs page (e.g., #/system/logs#/?since=...) reach this code path unsanitized and can include shell metacharacters such as command substitution ($(...)). A crafted link can therefore inject arbitrary shell commands into the constructed pipeline (set -o pipefail; ... | grep ... | sort -u) and execute them on the host. The provided PoC demonstrates writing the output of id into /tmp/cockpit-rce-proof, confirming code execution in the target environment.