Threats tagged 'ghsa-49mq-fc6q-3h46'

Token Optimizer MCP version prior to 5.1.0 contains an OS command injection vulnerability in its smart_user tool. The vulnerability arises because the username argument in the get-user-info operation is interpolated directly into a shell command executed via execAsync(), allowing command substitution inside double quotes. This enables an attacker controlling the username parameter to execute arbitrary shell commands with the privileges of the MCP server user. The issue is identified as CWE-78 and has a CVSS 3.1 score of 8.4 (high severity). A fix is available in version 5.1.0.