Lujie

A log parsing flaw exists where the `awk`-based parser extracts the first IPv4 address from log lines regardless of its field position. This allows an unauthenticated remote attacker to inject an arbitrary IP address through attacker-controlled fields, such as the login username field. Consequently, the system may block an incorrect target while the actual attacker remains unblocked.

An issue in the `tailscale.do login` RPC method allows authenticated users to execute arbitrary commands with root privileges. This occurs because the `loginserver` and `loginserver authkey` parameters are improperly quoted within a double-quoted shell command, enabling shell substitutions such as `$()` to be evaluated by the outer shell before argument processing.

An issue in the software allows a remote attacker to execute arbitrary code via the `cert manager.py` component.