This vulnerability in egtai gmx-vmd-mcp (up to version 0.1.0) allows remote attackers to perform command injection via the structure_file or trajectory_file parameters in the launch_vmd_gui_tool function of the mcp_server.py component. The flaw arises from improper handling of these arguments, enabling execution of arbitrary commands. The vulnerability is publicly known and exploitable remotely without privileges or user interaction. No official fix or patch has been released, and the vendor has not responded to the initial report.

Successful exploitation could allow an attacker to execute arbitrary commands on the affected system remotely, potentially leading to unauthorized control or data compromise. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS score of 6.9 indicates a medium severity impact, reflecting some limitations such as low complexity and low privileges required but limited scope or impact on confidentiality, integrity, or availability.

No official patch or remediation is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates or patches. Until a fix is provided, consider restricting network access to the affected service or applying application-layer filtering to validate and sanitize inputs to the launch_vmd_gui_tool function if possible. Avoid exposing the vulnerable component to untrusted networks.