A critical code injection vulnerability in the Yordam Library Automation System allows remote attackers to execute arbitrary code, potentially leading to full system compromise.

The application fails to properly sanitize input used in code generation (CWE-94), leading to an injection vulnerability. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that this is remotely exploitable without authentication, provided the attacker can initiate the required user interaction.

Code injection vulnerabilities represent a severe risk, as they can lead to complete system takeover, data exfiltration, and the installation of malicious software. With a CVSS score of 8.8, this flaw threatens the integrity and security of the entire library infrastructure and stored organizational data.

Immediate Action: Update to version 22.1 or later as provided by the vendor.

Proactive Monitoring: Monitor for unexpected server-side processes or unauthorized file modifications that could indicate successful code execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block common code injection payloads targeting the application's input fields.

Public Exploit Available: No

Given the potential for full system compromise, this vulnerability is of high urgency. Administrators must apply the vendor-supplied patch (version 22.1) immediately to eliminate the risk of arbitrary code execution.