The vulnerability allows an attacker to inject arbitrary Python code into the Flowintel configuration module by supplying malicious configuration keys to the alerts settings update endpoint. Configuration values are safely converted to Python literals, but the keys themselves are used unchecked when constructing assignment statements such as f'{key} = {py_val}'. This forms a code‑generation boundary because the modified configuration file is reloaded with importlib.reload(), executing the injected content. The result is arbitrary code execution in the context of the Flowintel process.

All Flowintel instances running version 3.3.0 or later are affected. This includes deployments where the alerts settings update API is exposed and the application has the permission to modify the conf/config_module.py file.

The CVSS score is 8.6, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote interaction with the alerts settings update endpoint, which requires authentication or privileged access to submit configuration changes. Once exploited, an attacker can execute arbitrary code with the privileges of the Flowintel process.