This vulnerability in NocteDefensor LudusMCP (<=1.0.24) involves command injection via manipulation of the command or args parameters in the executeArbitraryCommand and executeCommand functions of the ludus_cli_execute component. Exploitation requires local access, and no vendor remediation or patch has been published as of the report date. The CVSS 4.0 base score is 4.8, indicating medium severity with low attack complexity and requiring low privileges but no user interaction.

Successful exploitation allows an attacker with local access and low privileges to execute arbitrary commands on the affected system. This could lead to unauthorized command execution within the context of the application, potentially compromising system integrity or confidentiality depending on the environment. However, the attack vector is limited to local access, reducing the overall risk compared to remote vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict local access to trusted users only and monitor for suspicious local activity as a temporary measure until an official patch or mitigation is provided.