A command injection vulnerability exists in MODSetter SurfSense versions up to 2.0.3 within the MCP Connector Integration component at the /api/search-source/connectors/mcp/test endpoint. This flaw allows an attacker with low privileges to remotely execute arbitrary commands on the affected system. The vulnerability is tracked as CVE-2026-102243 with a CVSS 3.1 base score of 7.4, indicating a high-severity impact on confidentiality, integrity, and availability. The vendor has not responded to disclosure requests, and no official patch or remediation is currently available.

Successful exploitation of this vulnerability can lead to remote command execution, potentially compromising system confidentiality, integrity, and availability. The CVSS vector indicates that the attack requires low privileges and no user interaction but can be performed remotely. The availability of public exploit code increases the risk of exploitation, although no in-the-wild exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing network-level restrictions to limit access to the vulnerable endpoint and monitor for suspicious activity related to this component until an official fix is released.