A flaw in InfCode’s terminal auto‑execution module disables its blacklist filtering, allowing malicious PowerShell commands to run without user consent. The filtration logic fails to block high‑risk commands such as "powershell" and cannot detect obfuscation techniques like string concatenation, variable assignment, or double‑quote interpolation. Attackers can embed these commands in a file that, when opened in the IDE, causes the Agent to execute them, leading to arbitrary code execution or sensitive data leakage.

Tokfinity InfCode software – any release containing the terminal auto‑execution feature is vulnerable. No specific version numbers are listed, but the issue affects all builds that include this module.

The CVSS score of 7.8 categorizes the vulnerability as high severity, yet the <1% EPSS score suggests that exploitation is presently unlikely. It is not listed in the CISA KEV catalog, so no widespread exploitation has been documented. The attack is inferred to be a local or supply‑chain vector: an attacker must supply a crafted file that a user imports into the IDE; no remote network entry is described.