This vulnerability exists in suvarchal docker-mcp-server up to version 0.1.0 within the HTTP Interface component, specifically in the stop_container, remove_container, and pull_image functions of src/index.ts. It allows remote OS command injection due to improper input handling. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The project was notified early but has not issued a patch or official remediation.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected server, potentially leading to unauthorized system control or disruption. The impact is rated medium severity based on the CVSS score. No known active exploitation has been reported, but public exploit code exists, increasing the risk of future attacks.

As of now, there is no official fix or patch available from the vendor. Users should monitor the vendor's project for updates or patches. Until a fix is released, consider restricting network access to the affected service to trusted users only and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory or project repository regularly for remediation guidance.