This vulnerability (CVE-2024-43922) in NitroPack involves improper control over code generation, classified under CWE-94 (Code Injection). It affects NitroPack versions through 1.16.7. The CVSS 3.1 base score is 4.8, reflecting a network attack vector with high attack complexity, no privileges required, no user interaction, and impacts limited to low confidentiality and integrity loss without availability impact. No vendor advisory or patch information is provided, and NitroPack is not a cloud service, so remediation is the responsibility of the user or administrator.

The vulnerability allows for code injection that could lead to limited confidentiality and integrity impacts. There is no indication of availability impact or active exploitation. The medium CVSS score reflects these limited impacts and the high complexity required to exploit the vulnerability remotely without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor NitroPack vendor communications for updates. Until a patch is available, consider restricting network exposure of NitroPack instances and reviewing configurations to limit potential attack surface related to code generation features.