This vulnerability involves a code injection flaw in the executeCode function of the src/vm-executor.ts file in the execute Tool component of iatsiuk pptr-mcp. Versions 0.2.0 through 0.2.7 are affected. The flaw allows remote attackers to inject and execute arbitrary code. The vulnerability was responsibly disclosed but remains unpatched, and exploit code has been publicly released.

Successful exploitation could allow remote attackers to execute arbitrary code within the context of the vulnerable application, potentially leading to unauthorized actions or system compromise. The CVSS 4.0 base score of 5.3 reflects a medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider restricting network access to the vulnerable component and applying compensating controls to limit exposure.