This vulnerability in ChrisChinchilla Vale-MCP up to version 0.1.0 allows an attacker with local access and low privileges to perform OS command injection via the config_path argument in the HTTP Interface component (src/index.ts). The vulnerability requires local access and does not require user interaction. The CVSS 4.0 base score is 4.8 (medium severity), reflecting the local attack vector and limited complexity. The vendor has not provided any patch or fix, and the exploit has been made public, increasing the risk of exploitation.

Successful exploitation allows a local attacker with low privileges to execute arbitrary OS commands on the affected system. This can lead to unauthorized command execution, potentially compromising system integrity or confidentiality depending on the commands executed. However, the attack requires local access and low privileges, limiting the scope of impact compared to remote vulnerabilities.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is published, users should restrict local access to trusted users only and monitor for any suspicious local activity involving the config_path argument. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.