A command injection flaw exists in the /devserver/start endpoint of the leonvanzyl autocoder. An attacker who can send a request to this endpoint can supply a specially crafted command parameter that the server will execute directly, leading to arbitrary code execution. This vulnerability corresponds to CWE‑77 and enables an attacker to run whatever system commands they choose, potentially compromising the entire host.

The flaw affects installations running the leonvanzyl autocoder at commit 79d02a. No other versions or vendor products are listed, so the impact is confined to systems using that exact codebase.

The CVSS score of 9.8 indicates a critical severity, and although the EPSS score is not available, the lack of a KEV listing does not diminish the immediate risk. The attack can be performed remotely by sending an HTTP request with a malicious command parameter to the vulnerable endpoint, assuming the service is reachable from the network. Because the flaw allows execution of arbitrary commands, the attack surface is large and an exploit would likely succeed if the endpoint is publicly exposed.