This vulnerability involves command injection in the SecretDialog.showSecretDialog function of NocteDefensor LudusMCP (up to version 1.0.24). The manipulation of the Description argument in the get_credential_from_user component enables an attacker to execute arbitrary commands on the local host. The vulnerability requires local access and low privileges to exploit, with no user interaction needed. The project has been informed but has not issued a fix or response as of the publication date.

An attacker with local access and low privileges can exploit this vulnerability to execute arbitrary commands on the affected system. This could lead to unauthorized actions or compromise of the local environment. The CVSS score of 4.8 indicates a medium severity impact, reflecting limited attack vector (local) and privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should restrict local access to trusted users only and monitor for suspicious activity related to the affected function until an official fix is released.