An authenticated user can execute arbitrary operating system commands on the JoySafeter host because the application invokes subprocess.run with shell=True in Copilot standard mode. The lack of sandboxing allows the attacker to read other tenants' data, server secrets, and any other file accessible to the host account, constituting a severe confidentiality and integrity breach.

The vulnerability exists in jd-opensource:JoySafeter through version 1.0.0. No further version information is provided, and the CNA lists only the 1.0.0 release.

The CVSS score of 8.7 classifies the flaw as high severity, and the EPSS score is not available, which suggests no public data on current exploitation rates. The vulnerability is not listed in CISA’s KEV catalog. Attackers can self‑register on the platform, select the standard mode chat option (WebSocket chat.start), and trigger the vulnerable command execution path. Because the attacker only needs authenticated access, the effective attack surface is all legitimate users. The exploit would allow full code execution on the host machine.