OpenLearnX allowed an attacker to escape the Python sandbox used in its code execution environment, enabling arbitrary execution of system commands on the host. The flaw is a classic privilege escalation vulnerability that can compromise the confidentiality, integrity, and availability of the affected server. The vendor lists the weakness under several CWE identifiers indicating issues with hard‑coded privilege, authentication bypass, missing input validation, OS command injection, and code injection.

OpenLearnX versions prior to 2.0.3 are impacted; the forward‑compatibility of this issue is tied to the code execution module that shipped with releases up to and including 2.0.2. The patch was bundled in the 2.0.3 release and subsequent security builds.

The CVSS score of 8.8 signifies high severity, and while a concrete EPSS score is not available, the absence of an EPSS entry suggests limited current exploitation data. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote attacker leveraging a public code execution endpoint, bypassing sandbox controls, and executing arbitrary shell commands. Payload delivery could occur through the platform’s learning or assessment interfaces that accept user‑submitted Python code.