This vulnerability exists in ArtMin96 yii2-mcp-server 1.0.2 within the MCP Interface component's src/index.ts file, specifically in the yii_command_help and yii_execute_command functions. Improper input handling allows remote attackers to perform OS command injection, potentially leading to arbitrary command execution on the affected system. The flaw was responsibly disclosed but remains unpatched as of the publication date. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the server running yii2-mcp-server 1.0.2. This can lead to unauthorized system access, data compromise, or further attacks depending on the commands executed. Since the vulnerability is remotely exploitable without authentication or user interaction, it poses a significant risk to affected deployments.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's communications for updates. In the meantime, restricting network access to the affected service and employing application-layer firewalls or intrusion prevention systems to detect and block suspicious command injection attempts may reduce exposure. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.