This vulnerability involves a code injection flaw in the executeCode function of the src/vm-executor.ts file in the execute Tool component of iatsiuk pptr-mcp versions 0.2.0 through 0.2.7. The flaw enables remote attackers to inject and execute arbitrary code. The issue was responsibly disclosed to the project, but no remediation or patch has been provided as of the publication date. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to inject and execute arbitrary code within the affected component, potentially leading to unauthorized actions or system compromise. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts.

No official fix or patch is currently available. Users should monitor the vendor's communications for updates. Until a patch is released, consider restricting access to the affected component and applying compensating controls to limit exposure. Review usage of the executeCode function and avoid processing untrusted input if possible.