The vulnerability occurs in the get_obj_from_str function within RAE's Config-Driven Model Instantiation component, where passing a specially crafted Target argument enables arbitrary code execution on the host system. This is a code injection flaw tied to CWE-74 and CWE-94. The required attack vector is local, meaning an adversary must have physical or remote local access to the machine running the application. The CVSS score of 2.4 suggests low nominal impact, but the ability to execute code locally still poses a significant risk to the confidentiality and integrity of the system.

Affected systems include any installation of repository RAE that incorporates the code baseline up to commit a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041 or earlier. The product follows a rolling release model, so versions are not explicitly stated; anyone using an unsupervised or legacy deployment of the repository is potentially exposed.

Risk assessment shows that the exploitation probability is unclear because EPSS data is missing, but the vulnerability is not listed in CISA KEV and has a low CVSS. However, because the attack requires local access, the likelihood is limited to situations where an attacker can run code on the target machine. Nonetheless, a local attacker could exploit the flaw to execute arbitrary code, which could compromise the host or pivot to other systems. The lack of an official patch or workaround heightens the urgency for users to verify their deployments and mitigate locally before relying on the system in a production environment.