This vulnerability exists in the abdullah1854 MCPGateway up to commit 549f494a9e363f40530149de324b8097de424230. It impacts the getUsageByDateRange function in the Claude Usage Range Endpoint component, specifically in the file src/services/claude-usage.ts. The 'since' argument can be manipulated to perform command injection remotely. The product employs continuous delivery with rolling releases, so no discrete version numbers for affected or patched releases are provided. The vendor was notified early but has not responded or issued a patch. Public exploit code is available, though no active exploitation has been confirmed.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system via the 'since' argument in the getUsageByDateRange function. This could lead to partial system compromise depending on the privileges of the application process. The CVSS 4.0 score of 5.3 indicates a medium severity impact with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor the project repository or vendor channels for updates. Until a fix is available, consider restricting access to the affected endpoint or applying input validation and sanitization on the 'since' argument to mitigate command injection risks.