This vulnerability exists in the fuzz_domain function within src/index.ts of the MCP Interface component in BurtTheCoder mcp-dnstwist versions 1.0.0 through 1.0.4. Improper handling of the Request argument allows an attacker to perform OS command injection remotely. The issue was reported early to the project but remains unaddressed, and a public exploit is available. No official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation can lead to remote OS command injection, allowing an attacker to execute arbitrary commands on the affected system with the privileges of the application. This can compromise system integrity and confidentiality. The medium CVSS score reflects the potential impact balanced against the complexity and conditions required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing temporary mitigations such as input validation or restricting access to the vulnerable functionality until an official patch is available.