The vulnerability exists in the fuzz_domain function within src/index.ts of the MCP Interface component in BurtTheCoder mcp-dnstwist versions 1.0.0 through 1.0.4. By manipulating the Request argument, an attacker can perform OS command injection remotely. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. No official remediation or patch has been released by the vendor.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected system, potentially leading to system compromise or unauthorized actions. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9, indicating a significant risk but not critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider applying workarounds such as disabling or restricting access to the vulnerable function if possible, or isolating the affected component until an official patch is available. Monitor official channels for updates from the vendor.