Threats affecting pkg:github/avinashbole/quip-mcp-server

CVE-2026-4192 is a command injection vulnerability found in version 1.0.0 of AvinashBole's quip-mcp-server, specifically in the setupToolHandlers function within src/index.ts. This flaw allows remote attackers to execute arbitrary commands on the affected server without requiring user interaction or elevated privileges beyond low-level privileges. The vulnerability has been publicly disclosed, but no patch or vendor response is currently available. The CVSS 4.0 base score is 5.3, indicating a medium severity level. Exploitation could lead to partial compromise of confidentiality, integrity, and availability of the server.