Horilla HR allows authenticated users to request column exports through a POST parameter that is directly interpolated into a dynamic Python function definition and executed with exec(). By crafting a string that passes a safe literal evaluation but contains additional Python syntax, an attacker can inject arbitrary code into the function’s default argument, enabling execution of arbitrary operating‑system commands with the privileges of the web service process. The flaw is especially dangerous in the packaged Docker image, where the application runs as root, making a successful exploit equivalent to a full system compromise.

Vendors: Horilla HR. Any deployment using version 1.x or older is affected. The security advisory specifies that the issue is fixed in release 2.0.0, so all versions prior to 2.0.0 should be considered vulnerable.

The CVSS score of 8.8 classifies the vulnerability as high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog; however, the high impact and existence of authenticated vectors make it a serious risk. Attackers with legitimate user credentials can trigger the export function to inject arbitrary Python code, leading to command execution on the host, including root-level execution within the provided Docker image. An exploit requires only normal authenticated access and does not need additional network or privilege escalation steps.