The vulnerability resides in the GroovyEvaluator.evaluate function of the OpenAPI endpoint addWorkflowNode. By tampering with the nodeParams argument, an attacker can inject arbitrary Groovy scripts, leading to remote code execution on the PowerJob server and compromising confidentiality, integrity, and availability. This is a data injection flaw (CWE‑74) that allows runtime code injection (CWE‑94).

The flaw impacts PowerJob versions 5.1.0, 5.1.1, and 5.1.2. Users of these releases must confirm whether their environment utilizes the vulnerable OpenAPI endpoint.

The CVSS score of 6.9 denotes medium severity, and the attack can be conducted remotely without authentication, raising the risk level. No EPSS data or KEV listing is available, so the exploitation likelihood remains uncertain, yet the openness of the endpoint and lack of protective controls suggest a significant threat. Administrators should treat the vulnerability as a potential remote code execution risk until a patch is applied.