An issue in O2OA version 10.0.2 allows a local attacker to execute arbitrary code by bypassing the sandbox mechanism of the Invoke script execution. This flaw permits the attacker to run arbitrary commands or code with the privileges of the process that hosts the invocation service, potentially leading to full system compromise if the service operates with elevated rights.

The vulnerability is limited to O2OA, specifically version 10.0.2. No other vendor or product versions are currently known to be affected.

Because the exploit requires local access, it is not a remote attack vector, but the capacity for arbitrary code execution makes the risk high if an attacker can gain local foothold. The EPSS score indicates a very low probability of exploitation, and the CVSS score of 7.8 indicates high severity. The vulnerability is not listed in CISA KEV. It is inferred that an attacker with local access could execute any code, elevate privileges, or tamper with sensitive data.