OpenBullet2 up to version 0.3.2 contains an authenticated remote code execution flaw. By creating or editing job configurations, a legitimate user can run arbitrary C# code on the server. The C# execution environment has no reference filtering or API restrictions, enabling file system access, process creation, and arbitrary .NET API calls under the host process account. This vulnerability grants full compromise of the machine running the service.

The affected product is OpenBullet2, openbullet2, version 0.3.2 and earlier. Only authenticated users of the system can exploit the flaw, as the job configuration interface requires login credentials to create or modify jobs.

The CVSS score is 8.7, indicating a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid credentials and access to the job configuration interface; an attacker can subsequently execute arbitrary C# code, read or modify files, and spawn processes on the server host.