CVE-2026-79623: OS Command Injection in FishCodeTech Muteki

This vulnerability in FishCodeTech Muteki up to version 0.2.5 allows remote attackers to perform OS command injection via an unknown function involving the .claude/settings.json file in the Default Local Worker Backend component. The flaw permits execution of arbitrary OS commands, potentially compromising the affected system. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The project maintainers have indicated the project will be refactored and shut down, with no explicit patch or fix provided.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected system with limited privileges, potentially leading to system compromise or unauthorized actions. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed, increasing the risk of exploitation. However, no known exploits in the wild have been reported.

No official patch or fix is currently available. The project is planned to be refactored and shut down, implying no further development or security updates. Users should consider discontinuing use of affected versions (0.2.0 through 0.2.5) and migrating to alternative solutions. Monitor vendor communications for any updates regarding remediation or replacement.