This vulnerability in godot-mcp 0.1.0 involves command injection through the executeOperation function in src/index.ts, component create_scene/add_node. The issue arises from improper handling of the projectPath argument, which can be manipulated to execute arbitrary commands on the local system. Exploitation requires local access and privileges. The vulnerability was reported early to the project but remains unpatched as of the publication date.

An attacker with local access and privileges can exploit this vulnerability to execute arbitrary commands on the affected system. This could lead to unauthorized actions within the context of the application, potentially compromising system integrity or confidentiality depending on the environment and privileges of the attacker.

No official fix or patch is currently available from the vendor. Since the vulnerability requires local access, restricting local user privileges and monitoring for suspicious local activity may reduce risk. Users should monitor the vendor's advisories for updates and apply any future patches promptly.