This vulnerability exists in the INQUIRELAB mcp-bridge-api up to commit b30a82aa1d1d1139e0de846c41c8aadee6e06114. It involves command injection via manipulation of the command/args argument in an unknown function of the mcp-bridge.js file, which is part of the Servers Endpoint component. The attack can be initiated remotely without authentication or user interaction. Due to the rolling release nature of the product, no explicit affected or fixed versions are available. A pull request containing a fix has been submitted but is not yet accepted.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system, potentially leading to unauthorized control or disruption of the server running the mcp-bridge-api. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed as the fix is pending acceptance in a pull request. Users should monitor the vendor's repository or advisory channels for the official fix and apply it once available. Until then, restricting access to the affected component and applying network-level controls to limit exposure may reduce risk.