The vulnerability is a classic CWE‑94 code injection flaw in the workflow run_once endpoint. Because the backend executes user‑supplied code nodes with Python’s exec() function without any sandboxing, an authenticated user can inject arbitrary Python code that runs with the server’s privileges. This enables the attacker to read, modify, or delete files, access stored credentials, and reach internal network resources, effectively compromising the entire host where Bisheng is installed.

The affected product is Bisheng from dataelement. Versions prior to 2.6.0, including 2.4.0, are vulnerable. Any deployment running a pre‑2.6.0 release is at risk.

The CVSS score of 8.7 indicates a high‑severity remote code execution risk. No EPSS score is currently available, showing no published exploitation data. The vulnerability is not listed in the CISA KEV catalog. An attacker who has valid authentication credentials can craft tailored code node definitions and POST them to the /api/v1/workflow/run_once endpoint. The lack of input validation and the direct use of exec() allow the payload to execute with the service’s privileges, making the attack vector remote over authenticated API access.