The vulnerability resides in NLP.js 4.27.0 within the Evaluator.walkFunction method of the Condition Expression Pipeline component. Manipulation of the condition argument allows an attacker to inject arbitrary code, leading to remote code execution. The description explicitly states that the exploit can be launched remotely, implying that a remote attacker can supply a crafted condition to trigger the injection.

Affected systems are installations of AXA Group's NLP.js that use version 4.27.0. The issue is tied exclusively to this version; earlier or later releases are not indicated as vulnerable. Since the component is used for evaluating dynamic expressions, any hosting environment that exposes NLP.js API endpoints could be at risk if it accepts untrusted input.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS score is not available, so current exploitation probability cannot be quantified. The vulnerability is not listed in CISA's KEV catalog, but the lack of an official fix suggests that remediation depends on upgrading to a patched version if available, or otherwise mitigating the attack surface. Without remediation, a successful exploitation could lead to arbitrary code execution on the host running the NLP.js service.