The defect resides in the Project File Handler of QUSETIONS MiniCode‑Python, specifically the subprocess.Popen call in minicode/config.py. A crafted payload can cause the interpreter to execute arbitrary operating‑system commands. The vulnerability is exploitable remotely and, while the attack is described as high complexity, it is publicly disclosed and available for use. Successful exploitation would compromise confidentiality and integrity by allowing an attacker to run any commands the service user can execute.

The weak system is QUSETIONS MiniCode‑Python. Version 0.1.0 is impacted. The supplied patch in the 0.1.0‑rc1 release (commit 9d868dc2550f426c6ddf8ee98f30ffe450ca5e32) removes the vulnerability by re‑implementing the file handler. Any deployment running the earlier release without the patch is susceptible.

The CVSS score of 2.3 reflects low severity, matching the EPSS score of 1 % which indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, and the exploit is considered difficult although the attack vector is remote. In practice, the risk level remains low, but any exposed installation could still be targeted given the publicly available exploit code.