A command injection vulnerability exists in Sunwood-ai-labs command-executor-mcp-server versions up to 0.1.0. The flaw affects the execute_command function in the MCP Interface component, allowing remote attackers to execute arbitrary OS commands. The vulnerability has been publicly disclosed, and exploit code may be available. The project has not yet responded with a fix or mitigation.