The gmaps-mcp package has a high-severity vulnerability where its HTTP transport allows unauthenticated access to Google Maps API calls if the MCP_API_KEY environment variable is unset, which is the default in the example configuration. This enables attackers to make unlimited API calls billed to the operator's Google Cloud account. Additionally, there is an injection issue in the place_id parameter that can alter API endpoint semantics, potentially causing higher-cost calls. The vulnerability affects versions prior to 0.1.3 and has been fixed in version 0.1.3.