The ogensec-sdk package ships an Express middleware that, for each incoming request, sends a POST request containing {appId, endpoint} to a configured baseUrl. The response is interpreted as a list of items containing a hotfix.code string, which is wrapped and executed asynchronously using the AsyncFunction constructor with access to require, req, and res. This allows arbitrary JavaScript code from the remote server to run inside the Node.js process handling the requests, effectively enabling remote code execution. The package's distributed code is heavily obfuscated, hiding this mechanism from developers. Any compromise or MITM attack on the backend server providing these hotfix codes results in full RCE on all deployments using this middleware. The backend maintainer inherently has persistent remote execution access to every installation.

This vulnerability allows an attacker controlling or intercepting the configured backend server to execute arbitrary code within the Node.js process of every application using the ogensec-sdk middleware. This includes full access to require modules and live HTTP request and response objects, enabling complete compromise of the affected applications. The malicious code execution is persistent and undisclosed, posing a severe risk to confidentiality, integrity, and availability of affected systems.

No official patch or remediation is currently documented. Since the vulnerability relies on executing code fetched from a remote server, immediate mitigation involves discontinuing use of the ogensec-sdk package versions 1.1.1 and 1.2.1. Users should avoid deploying this package or remove it from existing deployments. Monitor vendor advisories for any official fixes or updates. Given the lack of source transparency and obfuscation, caution is advised when using this package or any similar middleware that executes remote code.