The vulnerability resides in the safishamsi Open‑Source GRAPHIFY library, affecting versions 0.3.2 through 0.4.29. Functions such as validate_url, safe_fetch, _build_opener, _fetch_html, and _download_binary do not adequately validate or restrict user‑supplied URLs, enabling an attacker to inject malicious code that the library then executes. The flaw is classified as CWE‑94 and allows an attacker to run arbitrary code, compromising confidentiality, integrity, and availability of the affected system.

All installations of Graphify between v0.3.2 and v0.4.29 are vulnerable. The product is distributed as open‑source software; the CVE does not list a specific vendor, so any deployment that incorporates these versions of Graphify is at risk.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based, in which an attacker must send a crafted URL to an application using Graphify; this is inferred from the description that arbitrary URLs are processed without validation. Successful exploitation would provide the attacker with the privileges of the process that invokes Graphify.