CVE-2024-46489: 
JavaScript vulnerability analysis and mitigation

A remote command execution (RCE) vulnerability exists in promptr v6.0.7 that allows attackers to execute arbitrary commands via a crafted URL. The vulnerability was discovered and disclosed on September 25, 2024 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code - 'Code Injection'). The issue stems from the application's ability to load prompt/template files from URLs without proper validation (GitHub).

Successful exploitation of this vulnerability could allow attackers to achieve high levels of confidentiality, integrity, and availability impact on the affected system. The vulnerability enables remote attackers to execute arbitrary commands, potentially leading to complete system compromise (NVD).

The vulnerability can be exploited remotely and requires low attack complexity. While user interaction is required, no privileges are needed for exploitation. An exploit has been publicly disclosed that demonstrates how attackers can control the prompt/template content to execute malicious commands (GitHub).