This vulnerability affects the aandrew-me tgpt product up to version 2.11.1 on Linux and macOS platforms. It arises from improper input handling in the helper.Update function of the Update Handler component, leading to command injection. Exploitation requires local access and does not require user interaction. The vulnerability was publicly disclosed without vendor remediation or patch availability. The CVSS 4.0 vector indicates low attack complexity and privileges required, with partial impact on confidentiality, integrity, and availability.

Successful exploitation allows a local attacker to inject and execute arbitrary commands on the affected system, potentially compromising system integrity and confidentiality. However, the attack requires local access, limiting remote exploitation. No known exploits in the wild have been reported. The medium CVSS score reflects moderate risk due to the local access requirement and partial impact on system security.

No official patch or remediation is currently available from the vendor, as they have not responded to the disclosure. Users should restrict local access to trusted individuals only and monitor for suspicious activity related to the helper.Update function. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.