This vulnerability exists in the create_sandbox_and_execute function of the scrapegraphai/nodes/generate_code_node.py file in ScrapeGraphAI scrapegraph-ai versions up to 1.74.0. It allows remote attackers to perform OS command injection by manipulating inputs to this function. The vulnerability has been publicly disclosed, but the vendor has not provided a patch or official remediation. The CVSS 4.0 base score is 5.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation could allow an attacker to execute arbitrary operating system commands remotely on affected installations of scrapegraph-ai. This could lead to unauthorized system access or control depending on the environment where the software is deployed. However, the vulnerability requires user interaction and has low exploit complexity, which somewhat limits the ease of exploitation. No known exploits in the wild have been reported at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's communications for any forthcoming updates or patches. Until a fix is released, consider restricting access to the affected component and applying network-level controls to limit exposure. Avoid providing untrusted input to the vulnerable function if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.