The vulnerability is an OS command injection flaw in the child_process.exec function within the run.js file of LuLu UI. By supplying crafted input, it allows a remote attacker to inject and execute arbitrary shell commands on the host. This can result in unauthorized data access, modification of system files, and disruption of service, thereby compromising confidentiality, integrity, and availability.

All instances of yued-fe LuLu UI up to and including version 3.0.0 are affected. No later releases are documented to contain a fix, and the vendor has not issued any public patch announcement.

The CVSS base score of 6.9 signifies medium severity, and an EPSS score of 2% indicates that exploitation is possible but not widespread. The flaw is exploitable remotely, most likely via the web interface that invokes the vulnerable child_process.exec call. Although the product is not listed in the CISA KEV catalog, the combination of a remote attack vector and the potential for arbitrary command execution makes this vulnerability a high priority for remediation.