This vulnerability exists in ipa-lab HackingBuddyGPT up to version 0.5.0 in the ssh_run_command function. It allows remote attackers to perform OS command injection by manipulating input to this function. The flaw was reported early to the project, but no fix or official response has been provided. Public exploit code is available, increasing the risk of exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system. This can lead to unauthorized system control or data compromise. The impact is rated medium due to the limited scope of confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation in the wild has been reported.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's advisory channels for updates. Until a patch is released, avoid exposing the vulnerable ssh_run_command functionality to untrusted networks or users. Consider implementing network-level restrictions or other compensating controls to limit remote access to the affected component.