This vulnerability (CVE-2024-45257) involves command injection in BYOB 2.0's payload build page, where the freeze function in core/generators.py improperly handles user-supplied input in the build parameter. This flaw permits remote attackers to execute arbitrary commands on the server without authentication. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or remediation level has been published by the vendor, and the affected versions are unspecified.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected server, potentially leading to partial loss of confidentiality, integrity, and availability. This could enable unauthorized control or disruption of the server hosting BYOB 2.0. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid exposing the vulnerable payload build page to untrusted networks or users. Implement network-level restrictions or application-layer filtering to limit access to the affected functionality. Monitor for unusual command execution activity related to BYOB 2.0 deployments.