This vulnerability exists in the create_sandbox_and_execute function of the scrapegraphai/nodes/generate_code_node.py file within the GenerateCodeNode component of ScrapeGraphAI scrapegraph-ai versions up to 1.74.0. It allows remote attackers to perform OS command injection, potentially executing arbitrary commands on the host system. The vulnerability has been publicly disclosed and exploits are available, but no official fix or remediation has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected system. This could lead to unauthorized system access or control. The CVSS 4.0 base score of 5.3 indicates a medium severity impact with low vector and integrity impact but no privileges required and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider mitigating exposure by restricting access to the vulnerable function or environment, applying network-level controls to limit remote access, or using application-level filters to sanitize inputs to the create_sandbox_and_execute function. Monitor for updates from the vendor for an official fix.