An issue in O2OA version 10.0.2 allows a local attacker to execute arbitrary code by bypassing the sandbox mechanism of the Invoke script execution. This flaw permits the attacker to run arbitrary commands or code with the privileges of the process that hosts the invocation service, potentially leading to full system compromise if the service operates with elevated rights.

The vulnerability is limited to O2OA, specifically version 10.0.2. No other vendor or product versions are currently known to be affected.

Because the exploit requires local access, it is not a remote attack vector, but the capacity for arbitrary code execution makes the risk high if an attacker can gain local foothold. No EPSS or KEV data is available, and the CVSS score has not been provided, but the confirmed local‑code‑execution capability itself indicates a severe threat. It is inferred that an attacker with local access could execute any code, elevate privileges, or tamper with sensitive data.