The vulnerability resides in the _route_using_overviews function of the backend/server.py module in PromtEngineer localGPT. By sending specially crafted input, an attacker can cause an injection that may allow execution of arbitrary code or commands. The description explicitly notes that the attack may be performed from remote, indicating that an unauthenticated client can trigger the flaw. The CVSS score of 6.9 portrays a moderate severity risk, and while the exploit is publicly disclosed, no critical mitigations are publicly published, raising the potential for widespread exploitation.

PromtEngineer localGPT is affected. The vulnerability applies to any release built from commit 4d41c7d1713b16b216d8e062e51a5dd88b20b054 or earlier. The project employs a rolling release model, so exact version numbers for patched releases are not advertised. Users should verify their local GPT component against the recent Git repository history for an updated build.

The attack vector is remote and does not require authentication, as evidenced by the description. Although the EPSS score is not available, the public disclosure and absence of vendor response suggest a realistic risk of exploitation. The CVSS score of 6.9 indicates that a successful attack could lead to significant damage, such as unauthorized code execution or data breach. The lack of inclusion in CISA's KEV catalog does not diminish the urgency, but it does reflect that the vulnerability is not yet widely catalogued in national spotting efforts.