A command injection vulnerability exists in ArtMin96 yii2-mcp-server version 1.0.2 and earlier. The flaw affects the functions yii_command_help and yii_execute_command in the MCP Interface component, allowing remote attackers with limited privileges to execute arbitrary OS commands. Exploit code has been published, but no official patch or vendor response has been provided yet. The vulnerability has a medium severity rating with a CVSS score of 6.3.