Offline Hospital Management System version 5.3.0 contains a configuration flaw in its Electron renderer that enables Node.js integration while disabling context isolation. This combination allows JavaScript code executed in the renderer process to access Node.js APIs, which can be used to invoke arbitrary operating system commands. Based on the description, it is inferred that the attacker would need to supply malicious JavaScript within the renderer process to exploit this weakness. The vulnerability thus permits the execution of arbitrary code with the privileges of the application user.

The flaw is limited to Offline Hospital Management System 5.3.0, an offline application used for hospital administration. No other versions or variants are reported as affected.

The CVSS score of 7.3 indicates a high severity, and the EPSS score of less than 1% suggests that exploits are currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require that an attacker delivers or runs malicious JavaScript in the renderer process, which could arise through local user interaction or the application's ability to load external content. Without a vendor patch, the risk remains significant for systems that allow untrusted code to be executed within the renderer.