This vulnerability affects Jij-Inc Jij-MCP-Server 0.1.0 specifically in the PythonREPL.run function located in the jij_mcp/python_repr.py file within the jm_check component. The issue arises from improper handling of the 'code' argument, enabling remote code injection. The vulnerability allows attackers to execute arbitrary code remotely. Although the project was notified early, there has been no vendor response or patch released. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and partial user interaction needed, with low confidentiality, integrity, and availability impacts. No known exploits are reported in the wild despite public exploit availability.

Successful exploitation could allow remote attackers to execute arbitrary code on the affected system, potentially compromising system integrity and confidentiality to a limited extent. The medium severity rating reflects partial impacts on confidentiality, integrity, and availability. No known active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider restricting network access to the affected service and applying additional controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.