CVE-2024-31380 is a critical code injection vulnerability in Soflyy Oxygen Builder (up to version 4.9) that allows attackers to inject and execute arbitrary code due to improper control of code generation (CWE-94). The vulnerability has a CVSS 3.1 base score of 9.9, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. Despite disclosure, the vendor Soflyy has refused to patch the issue, and no official remediation or temporary fix is available. This leaves affected installations exposed to potentially severe exploitation.

Successful exploitation of this vulnerability could lead to full compromise of the affected Oxygen Builder installations, including unauthorized code execution, data compromise, and service disruption. Given the critical CVSS score and the nature of code injection, attackers could gain control over the application environment. No known exploits in the wild have been reported yet, but the lack of vendor response increases risk for users.

No official patch or remediation is currently available as the vendor has refused to address the issue. Users should consider mitigating risk by discontinuing use of affected versions of Oxygen Builder or applying custom security controls such as strict input validation and code execution restrictions where possible. Monitor vendor channels for any future updates or advisories. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.