CVE-2026-51385 describes a remote code execution vulnerability in safishamsi Open-Source GRAPHIFY affecting versions 0.3.2 through 0.4.29. The flaw exists in several functions responsible for URL validation and content retrieval, including validate_url, safe_fetch, _build_opener, _fetch_html, and _download_binary. Exploitation requires user interaction and high attack complexity but can lead to high confidentiality impact and low integrity impact. No official fix or vendor advisory is currently published.

Successful exploitation could allow a remote attacker to execute arbitrary code on the affected system, potentially compromising confidentiality with limited integrity impact. The attack requires user interaction and has a high attack complexity, reducing the likelihood of widespread exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling untrusted URLs or content processed by the affected functions. Avoid running vulnerable versions in sensitive environments and monitor for updates from the vendor.