The A-G-U-P-T-A wireshark-mcp software contains an OS command injection vulnerability in the quick_capture function of pyshark_mcp.py. This vulnerability arises from unsafe handling of input that leads to injection of arbitrary OS commands. The issue can be triggered remotely without authentication or user interaction, with low attack complexity. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not yet issued a fix or official advisory. The product operates on a rolling release basis, complicating version-specific patch identification.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary operating system commands on affected systems, potentially leading to system compromise or unauthorized control. The CVSS score of 6.9 reflects a medium severity impact with network attack vector and no privileges required. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the affected service and applying any available workarounds if documented by the vendor.