The vulnerability is a code injection flaw (CWE‑94) that allows an attacker to execute arbitrary code within the Minecraft‑Rcon‑Manage application. This flaw arises from improper validation of user‑supplied input that is passed to the code generation component, enabling an attacker to inject malicious code and take control of the host system.

Affected systems include the pilgrimage233 Minecraft‑Rcon‑Manage application, specifically versions preceding 3.0. Any deployment running these earlier versions is susceptible until an update is applied.

The CVSS score of 10 indicates a critical impact with full exploitation possible. However, the EPSS score is below 1%, suggesting that the likelihood of exploitation in the wild is currently very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the RCON management interface, but the exact mechanism is not explicitly stated; it is inferred that an unauthenticated or authenticated attacker with RCON access could supply malicious code.