The vulnerability in nextlevelbuilder ui-ux-pro-max-skill (versions up to 2.5.0) resides in the _format_plugins function of the Tailwind Config Generator component, specifically in the file .claude/skills/ui-styling/scripts/tailwind_config_gen.py. This flaw enables remote code injection, potentially allowing attackers to execute arbitrary code. The issue was reported early via a pull request, but no vendor response or fix has been released. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow remote attackers to inject and execute arbitrary code within the affected component. This could lead to unauthorized actions or compromise of the system running the vulnerable software. However, there are no confirmed exploits in the wild at this time.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, consider restricting network access to the vulnerable component or applying other environment-specific controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.