The vulnerability resides in Archon 0.1.0, allowing an attacker to craft an HTML page that, when viewed by a victim, executes arbitrary commands and grants the attacker control over the Archon user interface. This enables the attacker to run prompts, manipulate UI features, and exfiltrate all information displayed in the UI, including API keys. The weakness results in a full compromise of confidentiality, integrity, and availability of the affected system, as the attacker can effectively assume the victim’s privileges. The identified weakness aligns with code injection and remote execution patterns as reflected in the associated CWE identifiers.

Archon version 0.1.0 is affected. No specific vendors or product families are listed; users running this release must assume the system is vulnerable.

The vulnerability can be exploited from a web client perspective; a victim merely needs to open the crafted HTML page to trigger execution, implying an unauthenticated and user‑initiated attack vector. The CVSS score of 6.3 indicates a moderate severity, and the EPSS score of <1% suggests a very low probability of exploitation. The absence of a KEV listing does not lessen the severity, as the described impact is substantial. Given the nature of the flaw, exploitation is likely straightforward and could be automated, making the risk high in environments where the vulnerable Archon UI is exposed to untrusted users or networks.