A command injection vulnerability (CVE-2026-7215) affects egtai gmx-vmd-mcp version 0.1.0. The vulnerability is located in the launch_vmd_gui_tool function of the mcp_server.py component, specifically involving the handling of the structure_file and trajectory_file arguments. Improper input validation allows an attacker to inject arbitrary commands remotely without requiring privileges or user interaction. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not issued a patch or official remediation. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector and no required privileges.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the affected system via the vulnerable function's parameters. This could lead to unauthorized system control or data compromise depending on the context of the deployed software. Since the vulnerability is remotely exploitable without authentication, it increases the risk exposure. However, no confirmed exploitation in the wild has been reported to date.

No official patch or remediation is currently available from the vendor. The project has not responded to the issue report. Users should monitor the vendor's channels for any forthcoming updates or fixes. Until a patch is released, consider restricting network access to the affected service or implementing input validation controls at the network perimeter to mitigate potential exploitation.