Threats affecting pkg:pypi/openakita

CVE-2026-3964 is an OS command injection vulnerability in OpenAkita versions up to 1.24.3, specifically in the Chat API Endpoint's run function within src/openakita/tools/shell.py. The flaw allows manipulation of the Message argument to execute arbitrary OS commands locally. Exploitation requires local access with low privileges and no user interaction, limiting remote attack feasibility. The vendor has not responded to the disclosure, and no patches are currently available. The CVSS score is 4.8 (medium severity), reflecting limited impact and exploitability. While no known exploits are in the wild, public exploit code exists, increasing risk if attackers gain local access.