The Vocos library contains an unsafe reflection vulnerability that permits attackers to perform arbitrary class instantiation, leading to potential remote code execution.

This vulnerability is caused by the use of externally controlled input to select classes for instantiation. An attacker can craft a configuration file that forces the application to load arbitrary classes, bypassing intended security boundaries.

Successful exploitation of this vulnerability can lead to arbitrary code execution within the context of the application. This poses a severe risk to the confidentiality and integrity of the host system, as an attacker could gain control over the application's execution flow. The high CVSS score of 8.8 reflects the potential for total system compromise.

Immediate Action: Review the project repository and vendor advisories for available security patches or updates; if no update is available, restrict the use of untrusted configuration files.

Proactive Monitoring: Audit application logs for unexpected class instantiation errors or deviations from expected configuration loading behavior.

Compensating Controls: Ensure the application runs with the principle of least privilege, limiting the potential impact if code execution is achieved.

Public Exploit Available: false

Users of the Vocos library should exercise extreme caution when processing configuration files from untrusted sources. As no patch version is explicitly defined in the provided data, stakeholders must monitor the official repository for updates and move to a secure version as soon as one is released.