An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dnsgcloudkey model field and directly interpolates the string fields gcloudaccount and gcloudproject into a shell command passed to procopen() via LeUtils::runshellcommand() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.