This vulnerability affects MoussaabBadla's code-screenshot-mcp up to version 0.1.0 in an unspecified part of its HTTP interface. It allows remote attackers to perform OS command injection, potentially leading to arbitrary command execution on the affected system. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability. The vendor has not provided any patch or remediation, and the vulnerability was publicly disclosed without vendor response.

Successful exploitation could allow remote attackers to execute arbitrary OS commands on the affected system, potentially compromising system integrity and confidentiality. However, the impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider applying workarounds such as restricting access to the vulnerable HTTP interface or deploying network-level protections to limit exposure until an official fix is released.