Threats tagged 'ghsa-4j22-92m7-7937'

A command injection vulnerability exists in r-huijts mcp-server-rijksmuseum versions up to 1.0.4 in the open_image_in_browser function of the MCP Interface component. Manipulating the imageUrl argument can lead to remote OS command injection. Public exploit code is available, but no patch or vendor response has been reported yet. The vulnerability has a medium severity rating with a CVSS score of 6.3.