This vulnerability affects chenhg5 cc-connect up to versions 1.4.0 and 1.4.1 in the Authenticate function located in core/webhook.go. An attacker can manipulate the exec argument to perform code injection remotely. The vulnerability has been publicly disclosed, with an exploit available, but no known active exploitation has been reported. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially compromising system integrity and confidentiality. The medium severity reflects the potential impact balanced with the complexity and scope of the attack.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected service and monitor for suspicious activity related to the exec argument in Authenticate calls.