Z.ai Zcode EUVD-2026-109610

Exploitation requires a low-privileged authenticated session (CVSS PR:L) on a Z.ai Zcode instance at or below version 3.14.3/3.15.1, and the attacker must be able to supply input that is processed by the Sed Command Filter component. The specific feature, endpoint, or configuration that routes attacker-controlled data into the sed/shell invocation is not described in the available sources, so the precise trigger cannot be stated with certainty. The principal limiting factor is the authentication requirement - it is not an unauthenticated flaw - and the input scoring indicates only limited (Low) confidentiality, integrity, and availability impact rather than full host takeover.

This is a moderate-risk issue that does not rise to emergency priority on the available signals. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) scores 5.3 and describes a network-reachable, low-complexity flaw that nonetheless requires some privilege (PR:L), so exploitation is authenticated rather than open to anonymous attackers. The exploit maturity is 'E:P' (proof-of-concept), consistent with the supplied PoC being a reference only. There is no CISA KEV listing and no EPSS score in the provided data, so there is no confirmed active exploitation and no modeled exploitation probability to weigh; absence of these is not evidence of safety but it does argue against treating this as actively weaponized. The VulDB priority decision label is 'this_month', which aligns with a real-but-not-urgent remediation posture rather than act-now. A notable tension: CWE-78 OS command injection would normally imply high integrity/availability/confidentiality impact (often full host compromise), yet the supplied vector rates all three impacts as Low (VC:L/VI:L/VA:L) - this suggests either constrained command execution within the Sed Command Filter or a conservative scoring by the single reporting source (VulDB). That discrepancy should be verified against the actual PoC or a vendor advisory before final prioritization.

An attacker who already holds low-privileged authenticated access to a Zcode instance submits crafted input that reaches the Sed Command Filter component, injecting operating-system commands that the application passes to a shell. Because the vector is network-reachable with low complexity, the request can be delivered remotely over the application's normal interface. A PoC reference has been published (a Feishu document), but it is not verified as working exploit code.