The vulnerability resides in Offline Hospital Management System 5.3.0 and permits an attacker to execute arbitrary operating system commands. The issue arises because the application enables Node.js integration while disabling context isolation in the Electron renderer process, permitting JavaScript code running in that context to access Node.js APIs and invoke system commands. This results in full remote code execution, which can allow attackers to compromise the host machine, exfiltrate sensitive patient data, or deploy further malware.

This flaw affects version 5.3.0 of the Offline Hospital Management System, an offline application designed for hospital management. No other versions or variants are listed as impacted; the vulnerability is limited to this specific iteration.

The danger level is high due to the ability to run arbitrary code. The known attack vector is through any code that is executed in the renderer process; it is unclear whether remote access is required or local privilege is needed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Without an official fix, the risk remains significant, particularly in environments where the application is exposed to potentially untrusted content or scripts.