LangBot contains an authenticated remote code execution (RCE) vulnerability allowing any authenticated user to execute arbitrary commands on the server by modifying the MCP Server Configuration to add an "STDIO" MCP with arbitrary commands. This vulnerability arises from the use of StdioServerParameters, which executes subprocess commands based on user input. Exploitation requires authentication, but once exploited, it can lead to full system compromise including data exfiltration, reverse shells, or destructive commands. The vulnerability affects LangBot versions up to and including 4.10.5.