An attacker can call the installFromUri method exposed by Halo’s PluginEndpoint and the DefaultPluginApplicationContextFactory to load and run arbitrary code with the same privileges as the running application. The flaw, a code injection vulnerability (CWE-94), stems from insufficient validation of external plugin sources and insecure handling of plugin artifacts, which grants remote code execution capability.

The vulnerability affects Halo 2.25.4. Administrators should verify whether their deployments include the PluginEndpoint and DefaultPluginApplicationContextFactory components and determine if the plugin installation endpoint is exposed to external traffic.

The CVSS score of 9.8 marks the flaw as critical. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote HTTP request to the plugin installation endpoint and does not require privileged access to the system. Given the high impact of arbitrary code execution, the overall risk remains high, especially for environments where the endpoint is reachable from untrusted networks.