FinRobot 1.0.0 includes a code injection flaw in the create_file_with_code() routine, which allows an attacker to execute arbitrary code by injecting malicious content that the function writes to a new file. This flaw represents a classic code injection weakness (CWE‑94), granting the ability to tamper with application logic or compromise the underlying host if the created file is subsequently executed. The impact is a high‑level compromise of confidentiality, integrity, and availability for any system running the vulnerable version.

The vulnerability is specific to FinRobot 1.0.0. No other product versions are known to be affected, and there is no information indicating that later releases contain the flaw. An organization that deploys this exact version must consider remediation.

Because no CVSS score or EPSS value is reported, the exact numerical severity is unknown, but code injection is universally regarded as a high‑risk vulnerability. The flaw appears to require that the attacker can invoke the vulnerable function within the application, suggesting the attack vector is local code execution or elevated privilege usage within the FinRobot environment. No exploitation reports are listed in the CISA KEV catalog. The lack of an official patch or work‑around means the risk remains persistent until a remediation is applied.