InfCode's terminal auto‑execution module contains a command filtering flaw that renders its blacklist ineffective, allowing malicious PowerShell commands to run without user confirmation. This results in arbitrary code execution, potentially compromising system integrity and leaking sensitive data. The weakness is a form of command injection (CWE‑78).

The vulnerability affects InfCode’s terminal auto‑execution component that is part of the IDE. No specific product names or version numbers are listed; any installation of InfCode that includes this feature is potentially vulnerable.

The CVSS score of 7.8 indicates a high severity level. An attacker can embed obfuscated PowerShell commands into a file and, when a user imports that file into the IDE, trigger execution of those commands. The exploit requires only the delivery of a malicious file and no additional conditions, suggesting a straightforward attack path. The EPSS score is not available, and the issue is not listed in the KEV catalog, but the simplicity of the attack makes exploitation likely.