Command injection in NPC start web endpoint (CVE-2026-22103) | HOL Guard CVE