PySpector versions 0.1.6 and earlier contain a validation bypass in the plugin system. The validate_plugin_code() function performs static AST analysis to block dangerous API calls, but its internal name resolver only processes ast.Name and ast.Attribute nodes. When a plugin uses indirect calls such as getattr(os, 'system'), the function node is ast.Call and the resolver returns None, causing the security check to be skipped. The plugin is then trusted and executed, allowing arbitrary system commands to run on the host machine. This results in full code execution where the attacker can run any command with the privileges of the user running PySpector.

The affected product is PySpector, developed by ParzivalHack. All releases 0.1.6 and earlier are vulnerable; the vulnerability was fixed in version 0.1.7.

The CVSS score of 8.3 reflects high severity, and the EPSS of less than 1% indicates a low but non-negligible exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious plugin that uses indirect function calls; once loaded by an untrusted user or automated test environment, the plugin can execute arbitrary code with the privileges of the user running PySpector.