This vulnerability affects the _format_plugins function in the file .claude/skills/ui-styling/scripts/tailwind_config_gen.py of the Tailwind Config Generator component in nextlevelbuilder's ui-ux-pro-max-skill product up to version 2.5.0. It allows remote code injection due to improper handling of input data. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity), indicating network attack vector, low attack complexity, no privileges required, and no user interaction needed. The issue was reported early via a pull request but remains unpatched as of the latest information.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely within the context of the affected application. This could lead to unauthorized actions or compromise of the system running the vulnerable component. The medium CVSS score reflects the moderate risk due to ease of attack and potential impact, but with some limitations in scope and privileges.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, consider restricting network access to the vulnerable component and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.