The INQUIRELAB mcp-bridge-api up to commit b30a82aa1d1d1139e0de846c41c8aadee6e06114 contains a command injection vulnerability (CWE-74) in an unspecified function of the mcp-bridge.js file within the Servers Endpoint component. This flaw allows remote attackers to execute arbitrary commands by manipulating the command or args arguments. The product follows a rolling release model, so no discrete version numbers for affected or patched releases are provided. A pull request addressing this vulnerability is awaiting acceptance, indicating no official fix is currently available.

Successful exploitation could allow remote attackers to execute arbitrary commands on the affected system, potentially leading to confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 7.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability.

No official fix is currently available as the pull request to address the vulnerability is pending acceptance. Users should monitor the vendor's repository or advisory channels for the acceptance and release of the patch. Until then, consider restricting network access to the affected component to trusted sources to reduce exposure.