PolarVista xcode-mcp-server 1.0.0 contains an OS command injection vulnerability in the build_project/run_tests function of the MCP Interface component (src/index.ts). The vulnerability arises from improper handling of the Request argument, allowing an attacker to inject operating system commands remotely without requiring privileges or user interaction. The vulnerability was publicly disclosed and assigned CVE-2026-7416 with a CVSS 4.0 score of 6.9 (medium severity). The vendor has not issued a patch or official response, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary OS commands on the affected server running PolarVista xcode-mcp-server 1.0.0. This could lead to unauthorized system access, data compromise, or disruption of service. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing network-level protections such as restricting access to the affected service and monitoring for suspicious activity related to command injection attempts. Avoid exposing the vulnerable service to untrusted networks until a patch or official mitigation is available.