The vulnerability is an arbitrary file upload flaw in the scalar_url query parameter of the Scalar Proxy endpoint. An attacker can upload a malicious SVG file that the server processes, enabling execution of arbitrary code. This results in remote code execution on the server hosting the Scalar Proxy.

The affected product is scalar/astro version 0.1.13. Any environment that runs this version and exposes the Scalar Proxy endpoint is vulnerable. No other versions or vendor products are currently listed as affected.

The CVSS score of 9.8 quantifies this vulnerability as critical, indicating that arbitrary file upload leading to remote code execution is indeed high risk. The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an HTTP request that supplies a crafted SVG file through the scalar_url parameter, allowing an attacker with access to the endpoint to execute arbitrary code on the server.