The vulnerability resides in the parse_cfg_args function of internal/utils/common.py within the Sidecar Parsing component of Linketic CityGaussian. Malicious manipulation of the cfg_args argument can lead to code injection, enabling an attacker to execute arbitrary code during the parsing process. The flaw corresponds to CWE-74 (Path Traversal) and CWE-94 (Improper Control of Generation of Code). The CVSS score of 2.4 reflects a low overall severity, and the impact is confined to the local environment where the code runs, allowing a local attacker to gain control over the application’s execution flow.

Vendors affected include Linketic, product CityGaussian, with all releases up to version 2.0 vulnerable. No specific patch or version details are provided, so every deployment of CityGaussian prior to an updated release is at risk.

The flaw requires a local execution context; therefore exploitation is limited to users or processes that have write access to the cfg_args input. The EPSS score is not available, and CityGaussian is not listed in the CISA KEV catalog, indicating that no active exploitation campaigns are publicly documented. The low CVSS score suggests minimal damage potential, but a local attacker could still elevate privileges or execute malicious code if trusted execution paths exist.