The vulnerability arises from the use of Python’s eval() within the _parse_op_part() function of the superduper query parser. Because the function does not fully restrict the execution environment, an attacker can embed arbitrary Python expressions, including imports of modules such as os, that execute system commands. The flaw permits the remote execution of code with the privileges of the server process, enabling a complete compromise of the host when a malicious query is submitted.

All releases of the open‑source SuperDuper project up to and including version 0.10.0 are affected. Any deployment that exposes the query interface provided by the repository is vulnerable. The issue is not tied to any commercial vendor; it originates entirely from the project's code base.

With a CVSS score of 8.8 the vulnerability carries a high severity rating, and its EPSS score is reported as below 1%, indicating that exploitation is not widely observed but still possible. The vulnerability is not listed in the CISA KEV catalog. An attacker who can reach the query parsing endpoint can supply a crafted query string that triggers the unsafe eval, giving them full remote code execution capability on the server.