Improper control of code generation in Azure Container Apps allows an attacker to inject and execute arbitrary code over the network. The flaw is a classic code injection weakness identified as CWE-94. If successfully exploited the attacker can compromise the container process, altering data, exfiltrating information, or causing service disruptions.

Microsoft Azure Container Apps is affected. No specific version information is disclosed; all deployments of Azure Container Apps are potentially vulnerable.

The CVSS score of 10 indicates the vulnerability is critical. Although the EPSS score is below 1%, suggesting currently low exploitation likelihood, the lack of a CISA KEV listing does not mitigate the inherent risk; any successful exploitation grants full control of the container. The attack vector is network‑based, meaning any network traffic to the container could be abused, so containment and patching are urgent.