This vulnerability exists in the execute_command function of the src/index.ts file within the MCP Interface component of Sunwood-ai-labs command-executor-mcp-server up to version 0.1.0. It allows an attacker to inject arbitrary OS commands remotely, potentially leading to unauthorized command execution on the affected system. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation can lead to arbitrary OS command execution on the affected server, which may compromise system integrity and confidentiality. The vulnerability is remotely exploitable without authentication, increasing the risk of unauthorized control. However, the CVSS score and vector indicate limited scope and impact compared to higher severity vulnerabilities.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or provided remediation, users should consider applying temporary mitigations such as restricting network access to the affected service and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.