The vulnerability is an untrusted search path issue in the fuse-archive program. The flaw allows an attacker who can manipulate the PATH environment variable or place a malicious binary in a directory that appears earlier in PATH to cause fuse-archive to execute that binary instead of the intended system executables. Because fuse-archive runs with the privileges of the user invoking it, the attacker can then run arbitrary code as that user. The weakness is categorized as CWE‑426. This enables local code execution with the user's rights, potentially affecting confidentiality, integrity, or availability of data or services accessed by fuse-archive.

The affected product is Google’s fuse-archive component. Versions older than 1.24 are susceptible. Starting with release 1.22 a partial mitigation was introduced, but the issue is fully resolved in 1.24 by applying selective PATH filtering. No other vendors or product variants are listed.

Based on the description, it is inferred that the attacker would be able to hijack execution by altering the PATH environment variable or placing a malicious binary in a directory earlier in PATH. The CVSS score of 5.4 indicates a medium risk severity. The EPSS score is not available, so exploitation probability cannot be quantified from EPSS; however the presence of the flaw does not appear in the CISA KEV catalog, suggesting no publicly known exploits. The attack requires local privilege to alter the PATH variable or to write to a path directory, so it is limited to scenarios where the user can influence their environment. Once achieved, the attacker can execute arbitrary code as the fuse-archive process.