The pskill9 website-downloader up to version 0.1.0 contains an OS command injection vulnerability in the download_website function of the MCP Interface component. Specifically, improper handling of the outputPath argument allows an attacker to inject arbitrary OS commands. This vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 score of 5.3 (medium severity). The project has been informed but has not issued a fix or mitigation guidance as of the published date.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary OS commands on the system running the vulnerable website-downloader software. This could lead to unauthorized system access or control depending on the privileges of the application process. The vulnerability is remotely exploitable and does not require user interaction, increasing the risk of automated attacks. However, no known exploits in the wild have been reported so far.

No official fix or patch is currently available from the vendor or project. Users should monitor the project repository or advisories for updates. Until a patch is released, avoid using the affected version (0.1.0) in untrusted environments or restrict access to the application to trusted users only. Consider applying manual input validation or sandboxing measures if feasible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.