This vulnerability in NellyW8 MCP4EDA 1.0.0 involves command injection via the manipulation of the design_name or vcd_file arguments in the run_openlane/view_waveform component. An attacker with local access and low privileges can exploit this flaw to execute arbitrary commands. The project was informed early through an issue report but has not provided a response or fix. No known exploits are reported in the wild.

Successful exploitation allows an attacker with local access and low privileges to execute arbitrary commands on the affected system, potentially leading to unauthorized actions or system compromise. The impact is limited by the requirement for local access and the low privileges needed.

No official patch or remediation has been announced by the vendor. Users should monitor the vendor's communications for updates. Until a fix is available, restrict local access to trusted users only and consider additional local security controls to mitigate risk.