The vulnerability resides in the ExecTool.execute method of DeepTutor 1.4.0, allowing attackers to inject arbitrary shell commands through the live tutorbot WebSocket interface. This code injection (CWE‑94) gives a remote attacker the ability to execute any command on the host system, leading to full compromise and potential data theft, destruction, or service disruption.

DeepTutor version 1.4.0 is affected. No vendor is listed in the official CNA records, but the flaw targets this exact software release and any installations that expose the live tutorbot WebSocket endpoint.

The attack vector is strictly remote; an attacker only needs the ability to establish a WebSocket connection to the live tutorbot interface to exploit the flaw. The CVSS score of 9.8 marks this as critical, while the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, yet the impact of full host control means that any successful exploitation would satisfy confidentiality, integrity, and availability objectives of the attacker.