This vulnerability in 0x4m4 HexStrike AI up to commit d689933ff579d839c676c82b231f8e98326c5f04 allows remote OS command injection via manipulation of the code/script argument in an unknown function within hexstrike_server.py's Execute Endpoint component. The product's rolling release model means no discrete version numbers are provided for affected or patched states. The issue was reported early to the vendor, who has not yet responded or released a patch. Exploit details have been publicly disclosed, but no known exploitation in the wild is reported.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially compromising system integrity and confidentiality. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS 4.0 score of 6.9 indicates a medium severity impact with low vector and integrity impact but notable availability and confidentiality impact.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the affected service and applying network-level controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.