The vulnerability in claude-hovercraft arises from the executeClaudeCode method's failure to properly validate a user-supplied string prior to executing it as a system call. This lack of input validation enables remote attackers to perform command injection, leading to arbitrary code execution with the privileges of the service account running the application. Authentication is not required to exploit this issue, making it highly critical. The affected repository has been removed, and no patch or fix details have been provided in the advisory. The Zero Day Initiative assigned a CVSS score of 9.8, reflecting the high impact and ease of exploitation.

Successful exploitation allows remote attackers to execute arbitrary code on affected installations without authentication. This can lead to full compromise of the affected system under the service account's privileges, impacting confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS score of 9.8. No known exploits in the wild have been reported at the time of disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected repository has been removed and no official fix or patch links are provided, monitor the vendor or Zero Day Initiative advisories for updates. Until a patch is available, consider restricting network access to the affected service or disabling it if feasible to prevent exploitation.