This vulnerability affects MoussaabBadla's code-screenshot-mcp up to version 0.1.0, specifically in an unspecified part of its HTTP interface. The issue permits remote OS command injection, enabling attackers to execute arbitrary commands on the host system. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, but with low impact on confidentiality, integrity, and availability. The vendor was notified but has not provided any remediation or patch. No known exploits in the wild have been reported.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary OS commands on the affected system, potentially leading to partial compromise of system integrity and confidentiality. However, the impact is rated medium due to limited scope and low impact on system availability and confidentiality as per the CVSS vector.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, users should consider mitigating exposure by restricting network access to the vulnerable HTTP interface, applying network-level controls, or discontinuing use of the affected version until a fix is released. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.