The career‑ops local dashboard was exposing an API that spawned operating‑system commands and allowed arbitrary file writes without first validating the request’s origin or limiting access to loopback addresses. An attacker could serve a malicious web page in the same browser session, send a cross‑origin request to the dashboard, and the backend would execute the supplied command as the user running the dashboard, potentially compromising the host machine. This flaw is a classic command‑injection coupled with cross‑site request forgery weakness.

The vulnerability exists in the santifer career‑ops application, specifically any installation running a version prior to web‑v0.8.0. All local dashboard instances that expose the /api routes are affected; npm installations are not, because the vulnerable routes are excluded from the published npm package.

With a CVSS score of 5.8, the flaw is considered moderate severity; the EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no publicly known exploits at present. The likely attack vector involves a malicious local resource or a page active in another browser tab that can issue cross‑origin HTTP requests to the dashboard. If the dashboard is bound to a non‑loopback interface, direct requests from the local network can also trigger the exploit. Because access is unauthenticated, any user with local OS privileges can exploit the vulnerability to run arbitrary commands or write files, giving the attacker full control over the host’s system privileges.