This vulnerability in O2OA v10.0.2 involves the sandbox mechanism used during Invoke script execution, which can be bypassed or manipulated by a local attacker to execute arbitrary code. The issue allows code execution with the privileges of the affected application, potentially leading to unauthorized actions on the system. No CVSS score or detailed technical exploit information is provided. No vendor advisory or patch information is currently available.

A successful exploit allows a local attacker to execute arbitrary code on the affected system, potentially leading to unauthorized control or actions within the context of the O2OA application. Since the attack requires local access, remote exploitation is not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to script execution within O2OA.