CVE-2025-12489 is a privilege escalation vulnerability in the evernote-mcp-server affecting the openBrowser function. The flaw arises from improper validation of user-supplied input before executing a system call, allowing a local attacker with low-privileged code execution to escalate privileges and execute arbitrary code as the service account. The vulnerability has a high severity score of 7.8 (CVSS 3.0). No affected versions or patches are specified.