Oinone Pamirs 7.0.0 contains a vulnerability where the ScriptRunner.run method evaluates attacker‑controlled script expressions without any sandbox or allowlist restrictions. This flaw allows an adversary to inject and execute arbitrary code on the host system, compromising confidentiality, integrity, and availability by effectively gaining full control over the application process.

The affected product is Oinone Pamirs version 7.0.0. No other versions or vendors are currently listed as impacted.

The vulnerability can be exploited by sending crafted expressions to the ScriptRunner API, which the underlying script engine executes with no restrictions. Because the code runs with the privileges of the application, successful exploitation leads to full remote code execution. The exploitation probability is not quantified by an EPSS score and the vulnerability is not yet listed in the CISA KEV catalog, but the inherent lack of input validation suggests a high likelihood of exploitation if the interface is reachable. The CVSS severity score of 6.5 indicates medium severity, yet the absence of sandboxing still permits arbitrary code execution with the application’s permissions.