This vulnerability involves OS command injection in the quick_capture function of pyshark_mcp.py in the A-G-U-P-T-A wireshark-mcp project. The injection occurs because user input is improperly sanitized or validated before being passed to an OS command execution context. The attack vector is remote network access with no privileges or user interaction required, and the vulnerability has low to limited impact on confidentiality, integrity, and availability. The project operates on a rolling release basis, and no vendor response or patch has been issued as of the publication date.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary OS commands on the affected system, potentially leading to partial compromise of the system's confidentiality, integrity, and availability. However, the CVSS score of 6.9 and vector indicate limited impact and no requirement for user interaction or privileges. There are no confirmed exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor the project repository or issue tracker for updates. Until a fix is released, avoid exposing the vulnerable functionality to untrusted networks or inputs.