A code injection flaw exists in the scriptEngine.eval function within ExpressionRule.java of the AutohomeCorp Frostmourne product. The flaw allows an attacker to supply arbitrary JavaScript expressions that are evaluated by the Oracle Nashorn engine, enabling remote execution of malicious code. This weakness maps to CWE-94 (Code Injection) and CWE-74 (Improper Neutralization of Input).

AutohomeCorp Frostmourne versions up to and including 1.0 are affected. No later version information is provided.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a relatively low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by sending a crafted EXPRESSION value to the vulnerable endpoint; successful exploitation would give the attacker code‑execution privileges within the application context.