An injection flaw in the generate_df function of bagofwords1 bagofwords permits attackers to inject data that is processed by the backend, allowing remote execution of arbitrary code. The flaw aligns with CWE-74 for input injection and CWE-707 for unsafe handling of user-provided data. Because the exploit is publicly available and can be triggered over the network, an attacker can compromise the entire application if they gain access to the remote interface. The vulnerability can lead to loss of confidentiality and integrity of application data, as well as denial of service if the injected content disrupts normal function.

bagofwords1 bagofwords versions up to and including 0.0.297 are affected. Updating to version 0.0.298, which contains the referenced patch with commit hash 47b20bcda31264635faff7f6b1c8095abe1861c6, resolves the issue.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, which does not allow precise quantification of exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the publicly available exploit and remote attack surface increase the practical risk. Exploitation requires network access to the application and the ability to supply crafted input through the generate_df endpoint, making it a remote exploitation vector.