This vulnerability affects idachev mcp-javadc up to version 1.2.4 in an unspecified function within the HTTP Interface component. By manipulating the jarFilePath argument, an attacker can perform OS command injection remotely without requiring authentication or user interaction. The vulnerability is publicly disclosed with an available exploit, but the vendor has not issued any patch or official remediation at this time.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system, potentially leading to unauthorized control or disruption. However, no confirmed exploitation in the wild has been reported. The vulnerability does not require privileges or user interaction, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying workarounds such as restricting network access to the HTTP Interface or disabling the vulnerable component if possible until an official fix is available.