This vulnerability affects the Authenticate function in the core/webhook.go file of chenhg5 cc-connect up to versions 1.4.0 and 1.4.1. The flaw allows remote attackers to inject code by manipulating the exec argument. Although the exploit has been publicly disclosed, there is no vendor-provided patch or official remediation level indicated. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9, reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected system by manipulating the exec argument in the Authenticate function. This could lead to partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by the vendor, users should monitor for updates from the vendor or community. Until a fix is available, consider restricting access to the vulnerable function or applying network-level controls to limit exposure.