This vulnerability represents an improper control over code generation, allowing an attacker to hijack the Lua interpreter by injecting crafted bytecode. The result is arbitrary code execution within the context of the perf-ninja application, potentially compromising confidentiality, integrity, and availability of the entire system. The weakness is classified as CWE‑94, which confirms that code injection can occur when untrusted input is used to generate or execute program code.

The affected product is dendibakh's perf‑ninja, specifically the Lua modules under labs/misc/pgo/lua. No specific version numbers are listed in the CNA data; the issue appears in the current codebase as referenced in pull request 129.

The CVSS score of 10 indicates a critical level of risk. Exploit probability data (EPSS) is not available, and the vulnerability is not catalogued in CISA’s KEV list. Based on the description, the failure to control bytecode generation suggests that an attacker who can supply or modify Lua bytecode—potentially through local file manipulation or networked input to the perf‑ninja service—can trigger arbitrary code execution. No additional exploitation prerequisites are detailed, but the severity implies that any successful injection would have system‑wide impact.