IBM Bob Shell versions 1.0.4 through 2.0.1 contain a code injection flaw (CWE‑94) that allows a remote attacker to execute arbitrary code. The vulnerability arises from improper control of user‑supplied code, enabling injection of malicious scripts that run with the privileges of the Bob Shell process. Successful exploitation results in loss of confidentiality, integrity, and availability on the affected host.

The affected product is IBM Bob Shell, specifically the 1.0.4 to 2.0.1 release line. Users running any of these versions without applying the recommended upgrade are exposed to attack.

The CVSS score of 8.8 indicates high severity. EPSS data is not available and the issue is not yet listed in CISA KEV, suggesting no confirmed public exploits. The likely attack vector is the remote injection of malicious code via an untrusted repository or code snippet that a user opens or executes. If exploited, the attacker can gain full control over the Bob Shell process, potentially compromising the entire system.