This vulnerability in PowerJob 5.1.x series involves the GroovyEvaluator.evaluate function used in the OpenAPI endpoint /openApi/addWorkflowNode. By manipulating the nodeParams argument, an attacker can perform remote code injection. The CVSS 4.0 base score is 6.9, reflecting network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vendor has not yet provided a remediation or patch, and the project has not responded to the issue report.

Successful exploitation allows remote attackers to inject and execute arbitrary code via the nodeParams parameter in the affected endpoint. This can compromise the affected system's integrity and potentially confidentiality and availability to a limited extent. There are no known active exploits reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded and no official fix is available, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity. Avoid exposing the /openApi/addWorkflowNode endpoint to untrusted networks until a fix is released.