Azure Pipelines Remote Code Execution Vulnerability

According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
An attacker would need specific conditions to be in place (i.e. particular protocol settings, or configurations, etc.) before an attack could succeed, which reduces the likelihood of widespread or opportunistic exploitation.

How could an attacker exploit this vulnerability?
An authenticated contributor could place specially crafted content in application files processed by an existing Azure Pipelines build. Under specific pipeline configurations, successful exploitation could allow the attacker to execute code as the pipeline agent account. Additional user interaction is not required when the pipeline runs automatically.