Minimax Code CVE-2026-120275

Exploitation requires the attacker to reach the Find Command Handler and control the -exec argument, which per the CVSS vector demands low-level authenticated privileges (PR:L) to the Minimax Code application plus passive user interaction (UI:P) to complete the attack. The limiting factors are therefore: a valid low-privilege account is needed (not fully unauthenticated), the attack cannot succeed without the required user interaction, and only Minimax Code version 0.5.8 is identified as affected. The vendor rated confidentiality, integrity, and availability impacts as Low, suggesting the injected commands execute in a constrained context rather than yielding full host takeover, though the sources do not describe the execution privileges in detail.

This is a medium-severity issue (CVSS 4.0 base 5.1) that does not rise to an urgent, widespread priority despite being an OS command injection (CWE-78) flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L) indicates a network-reachable attack with low complexity but requires low-level privileges (PR:L) AND passive user interaction (UI:P), and the vendor rated all three impacts as Low rather than the full system compromise command injection often implies. The vuln.today decision label is 'this_month' - meaningful but not emergency/act_now. There is no CISA KEV listing and no EPSS score was supplied, so exploitation probability cannot be quantified from the input; absence of an EPSS value is a data gap, not evidence of low risk. No POC field was provided, but the references include an external Feishu (feishu.cn) document alongside the VulDB CTI entries, so a public reference likely containing exploitation detail exists though it is not verified as working exploit code. The dominant risk-limiting factor is the product itself: an obscure, single-vendor tool from Shanghai Xi Yu Ji Zhi Technology with no enterprise footprint, meaning real-world exposure is minimal regardless of the technical mechanism. Net: a legitimate but low-urgency issue - the low privilege requirement, required user interaction, Low-rated impacts, and rare deployment outweigh the network attack vector.

A low-privileged authenticated user of Minimax Code 0.5.8 supplies a crafted value to the -exec argument of the Find Command Handler, injecting attacker-controlled OS commands that the application executes. Because the CVSS vector specifies UI:P, some passive user interaction is a prerequisite for the attack to succeed. A public reference describing the issue exists, but it is not verified as working exploit code.