This vulnerability is an OS command injection flaw located in the Find Command Handler component of Minimax Code version 0.5.8. By manipulating the -exec argument, an attacker can execute arbitrary commands on the host operating system. The weakness is recognized as CWE-77 and CWE-78, indicating improper handling of external input that is later passed to the system shell.

The affected product is Minimax Code from Shanghai Xi Yu Ji Zhi Technology, specifically version 0.5.8. The vulnerability resides in an unknown part of the component that processes the –exec argument.

The CVSS score of 5.1 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in CISA KEV. The described remote attack vector suggests that an external adversary can supply a crafted –exec string over the network to trigger the injection. No special privileges or additional software are required beyond remote access to the affected component, making the exploitation path relatively straightforward.