Horilla-hr before version 2.0.0 contains a code injection vulnerability (CWE-94) in the horilla_views/generic/cbv/views.py file. The export_data function accepts a POST parameter 'columns' from authenticated users, extracts a field from it, and interpolates it into a dynamically constructed Python function string. This string is then executed using exec(). Because the crafted input can remain valid under ast.literal_eval but still inject Python syntax into a default argument evaluated during function definition, an attacker can execute arbitrary OS commands with the application's privileges. The vulnerability is resolved in version 2.0.0.

Successful exploitation allows an authenticated user to execute arbitrary operating system commands with the privileges of the application process, which by default includes root privileges in the shipped Docker image. This can lead to full system compromise, data loss, or unauthorized control over the host environment.

Upgrade horilla-hr to version 2.0.0 or later, where this vulnerability is fixed. No other mitigation steps are specified or required as the fix addresses the root cause.