This vulnerability in Braffolk mcp-summarization-functions (up to version 0.1.5) involves OS command injection via manipulation of the command argument in an unspecified function of src/server/mcp-server.ts, specifically in the summarize_command component. The attack requires local access and does not require user interaction. The vendor was notified but has not provided a fix or advisory. The CVSS 4.0 vector indicates low attack complexity and privileges required, with no user interaction needed. No official patch or workaround is currently available.

Successful exploitation allows a local attacker to execute arbitrary operating system commands on the affected system, potentially leading to unauthorized actions or system compromise. However, the attack requires local access and low privileges, limiting the scope to users who already have some level of access to the system. There are no reports of active exploitation in the wild.

No official patch or remediation is currently available as the vendor has not responded to the disclosure. Users should restrict local access to trusted users only and monitor for suspicious activity related to the affected component. Check the vendor's site or trusted advisories regularly for updates or patches. Avoid using affected versions if possible until a fix is released.