The superduper project through version 0.10.0 contains a critical remote code execution vulnerability due to unsafe use of eval() in its query parsing component. The _parse_op_part() function dynamically evaluates user input with insufficient restrictions, enabling attackers to run arbitrary Python code, including importing modules like os to execute system commands. This flaw allows remote attackers to fully compromise the affected server. The vulnerability is publicly disclosed but lacks a CVSS score and official remediation details. The project is not a cloud service, so remediation depends on vendor or user patching.

Successful exploitation allows remote attackers to execute arbitrary system commands on the server running the vulnerable superduper version, leading to full server compromise. This can result in unauthorized data access, system control, and further network penetration. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable query parsing functionality to untrusted users or inputs. Consider applying temporary mitigations such as input validation or disabling the affected feature if possible.