This vulnerability exists in the API Tools Endpoint component of 0x4m4 HexStrike AI, specifically in the subprocess.Popen function within hexstrike_server.py. An attacker can remotely exploit this by manipulating the arguments additional_args, target, username, password, scan_type, or payload to inject OS commands. The product lacks versioning, so no specific affected versions are identified. A patch or official fix is not yet available but is in progress. Exploit code has been publicly released, but no known exploitation in the wild has been reported.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to system compromise. The vulnerability is remotely exploitable without authentication and requires low attack complexity. The overall impact is rated medium based on the CVSS 4.0 vector.

A fix is currently in progress; no official patch is available at this time. Users should monitor vendor advisories for updates and apply the official fix once released. Until then, consider restricting access to the vulnerable API endpoint to trusted networks or users to reduce exposure.