This vulnerability exists in Jij-Inc Jij-MCP-Server 0.1.0 within the PythonREPL.run function of the jm_check component (file jij_mcp/python_repr.py). The flaw allows an attacker to remotely inject code by manipulating the 'code' argument, leading to arbitrary code execution. The issue was responsibly disclosed early but remains unpatched as of the publication date. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low attack complexity, and partial user interaction required. No official fix or remediation guidance is currently available.

Successful exploitation enables remote code injection and execution on the affected server, potentially compromising system integrity and confidentiality. The medium CVSS score reflects moderate impact with some user interaction needed. No known active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level protections to restrict access to the vulnerable service and monitor for suspicious activity related to code injection attempts.