This vulnerability exists in the abdullah1854 MCPGateway up to commit 549f494a9e363f40530149de324b8097de424230. The flaw is in the getUsageByDateRange function of src/services/claude-usage.ts, where improper handling of the 'since' argument leads to command injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. The project uses continuous delivery with rolling releases, so no discrete version numbers for affected or fixed releases are available. The vulnerability was reported early but remains unaddressed, and public exploit code exists.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected system with low privileges and no user interaction. This could lead to partial compromise of the system, data manipulation, or disruption of service. The CVSS score of 5.3 reflects a medium impact with limited scope and complexity.

Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance. Since the project has not responded to the report and no fix is publicly available, users should consider mitigating exposure by restricting access to the vulnerable endpoint or applying temporary controls until an official fix is released.