The vulnerability is located in the Calculate function of the WF_CCForm.java component in the opencc JFlow project. An attacker can manipulate input to this function, enabling arbitrary payload injection. The documented CWEs indicate that the flaw permits code injection and command injection, suggesting that injected content may be executed or processed by the system. The nature of the flaw means that malicious input could alter execution flow or inject harmful commands, potentially compromising application logic or data integrity.

All publicly available releases of opencc JFlow up to the commit 5badc00db382d7cb82dad231e6a866b18e0addfe contain the affected Calculate function. Because the project follows a rolling release model, specific version numbers are not publicly disclosed; any instance running before the fix commit remains vulnerable.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score of less than 1% reflects a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The stated attack vector is remote, and the exploit is publicly available, implying that exposure over web interfaces could be sufficient for an attacker to manipulate inputs. Without an official patch, the risk endures until a fixed release or mitigation is applied.