helper.Update in the helper.go file of aandrew-me tgpt allows an attacker with local user privileges to inject arbitrary shell commands by manipulating the update process. The vulnerability qualifies as a command injection flaw (CWE‑74) and results in the execution of external commands under the context of the running process, compromising confidentiality and integrity of the affected system.

Affected systems include the aandrew-me tgpt application version 2.11.1 or earlier running on Linux or macOS platforms. The vulnerability resides in the Update Handler component and is present wherever the vulnerable code is deployed.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available, so the current exploit probability cannot be quantified. The vulnerability is not listed in CISA KEV. The exploit can only be carried out by a local attacker who can execute code within the application, making local privilege escalation or compromised user accounts a prerequisite. The lack of an external exploitation vector reduces threat but local attackers can still leverage the flaw to gain further privileges, file access, or execute arbitrary commands.