Threats affecting pkg:github/egtai/gmx-vmd-mcp

CVE-2026-7215 is a command injection vulnerability in the egtai gmx-vmd-mcp product version 0.1.0. The flaw exists in the launch_vmd_gui_tool function within the mcp_server.py file, where manipulation of the structure_file or trajectory_file arguments can lead to command injection. This vulnerability can be exploited remotely without authentication. The issue was reported to the project early, but no response or fix has been provided yet. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.