Threats affecting pkg:github/chatboxai/chatbox

CVE-2026-6130 is a medium severity OS command injection vulnerability in chatboxai chatbox versions up to 1.20.0. The flaw exists in the StdioClientTransport function within the Model Context Protocol Server Management System component. An attacker can remotely manipulate the args/env arguments to execute arbitrary OS commands. Although the vulnerability is publicly known and an exploit has been published, the vendor has not yet responded or issued a patch. No official remediation or fix is currently available.