This vulnerability in jackwrichards FastlyMCP up to commit 6f3d0b0e654fc51076badc7fa16c03c461f95620 involves OS command injection via manipulation of the 'command' argument in the fastly-mcp.mjs component of the fastly_cli tool. The flaw allows remote attackers to execute arbitrary operating system commands. The project uses a rolling release for continuous delivery, so no discrete version numbers for affected or patched releases are available. The vendor has been notified but has not yet provided a response or patch. The product is delivered as a cloud service, which generally means the vendor manages remediation server-side. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized system control or data compromise. The medium CVSS score reflects moderate impact with low complexity and no required privileges or user interaction. There are no known exploits in the wild at this time. Since the product is a cloud service, the impact depends on the vendor's remediation actions and deployment environment.

The vendor has not yet responded with an official fix, but patch availability is indicated. Because this is a cloud-hosted service, the vendor typically manages remediation server-side. Users should monitor the vendor advisory for updates and apply patches or updates as soon as they become available. Until then, no specific user-side mitigation is confirmed. Patch status is not yet fully confirmed—check the vendor advisory for current remediation guidance.