The vulnerability in the load_human_activity_segmentation_datasets method stems from a lack of input validation before executing user‑supplied strings as Python code. This flaw falls under CWE-94 and permits a remote attacker to run arbitrary commands within the current process context. The potential impact is full compromise of the affected system, as any code injected can read, modify, or exfiltrate data and perform privileged actions, depending on the execution environment of the aeon process.

This issue affects installations of the aeon toolkit, specifically the aeon product. No specific version range is supplied in the advisory; protected environments should verify the presence of the vulnerable method regardless of the aeon release.

The CVSS score of 7.8 places the vulnerability in the Medium‑High category, indicating that exploitation would grant significant control to an adversary. The EPSS score is not available, so the current probability of exploitation cannot be quantified, but the vulnerability can only be abused when the target visits a malicious page or opens a malicious file, implying user interaction is required. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation is documented at this time.