The vulnerability in the ZAI-Shell agent allows an unauthenticated remote attacker to open a TCP socket on port 5757 and send arbitrary system commands to a P2P terminal sharing session that is running in "--no-ai" mode. If a host user approves a command without reviewing it, that command is executed directly with the user’s privileges, bypassing all Sentinel safety checks. This flaw is a typical example of an unauthenticated command injection (CWE‑94) that can compromise the confidentiality, integrity, and availability of the affected system.

TaklaXBR’s ZAI-Shell software, any installation of the product that is on a version earlier than 9.0.3, is susceptible to this flaw.

The flaw carries a high severity CVSS score of 8.8, indicating a substantial potential for damage. However, the EPSS score is less than 1 %, indicating that real‑world exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated, and relies on an open network service; an attacker needs only to open a socket and send commands. If the host user does not verify command contents, the result is direct execution of attacker‑supplied commands with the user’s privileges.