The vulnerability allows the Camel AI CodeExecutionToolkit to run model‑produced Python code via a SubprocessInterpreter without any approval, enabling an attacker to execute arbitrary code in the host environment. This can compromise confidentiality, integrity, and availability of the system when a malicious model output is processed.

Camel‑AI camel library versions 0.2.91a1, 0.2.91a2 and 0.2.91a3 are affected. No other product or version information is listed.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of < 1% suggests a low probability of exploitation. The absence of an approval boundary creates a clear path for code execution. The vulnerability is not catalogued in CISA KEV. The likely attack vector is the insertion of malicious content into a model’s prompt or dataset, with backend systems executing it without verification. This represents a high‑impact risk if the application processes untrusted inputs.