The vulnerability in Krayin CRM version 2.1.5 allows a remote attacker to execute arbitrary code via the compose email function by abusing improper control of code generation, enabling malicious code to run on the server with the privileges of the application process. This is a code injection flaw (CWE‑94) that allows arbitrary code to be injected and executed. The impact is a complete compromise of confidentiality, integrity, and availability of the affected system.

Krayin CRM v2.1.5 is affected. The issue was fixed in v2.1.6. No other affected versions are listed.

The CVSS score of 8.1 indicates high severity, confirming the extreme risk of arbitrary code execution via the web‑based compose email interface. The EPSS score is < 1% (about 0.0008), indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the absence of mitigation does not reduce the inherent severity. The likely attack vector (inferred) is a remote web request to the compose functionality, which can be performed by any authenticated or unauthenticated user depending on the application's access controls. Remediation requires rapid application of the vendor patch or disabling the vulnerable feature.