This vulnerability affects usestrix strix up to version 1.0.2 and involves the inclusion of functionality from an untrusted control sphere due to manipulation of an unspecified function in the file system_prompt.jinja template within the PyPI Handler component. The attack can be performed remotely but requires a high level of complexity and is considered difficult to exploit. The vendor was contacted but did not respond, and no remediation or patch has been published. The CVSS 4.0 base score is 2.3, indicating low severity.

The vulnerability allows an attacker to include functionality from an untrusted control sphere, which could potentially lead to unintended behavior or code execution within the affected component. However, the low CVSS score and high attack complexity suggest limited impact and low likelihood of successful exploitation. No known exploits are reported in the wild.

No official fix or patch is currently available from the vendor. Due to the lack of vendor response, users should consider mitigating exposure by restricting access to the affected component or applying custom controls to validate inputs related to the PyPI Handler's system_prompt.jinja usage. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.