Command injection in MCPGateway's Claude Usage Range Endpoint allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `since` date argument passed to `getUsageByDateRange` in `src/services/claude-usage.ts`. All versions up to commit 549f494a9e363f40530149de324b8097de424230 are affected, with a proof-of-concept exploit publicly available via the project's GitHub issue tracker. No patch has been released; the maintainer has not responded to the coordinated disclosure despite early notification, leaving deployments with no vendor-supported remediation path.
Heap-based buffer overflow in MZ Automation libiec61850 up to version 1.6.1 allows a local attacker with low privileges to corrupt heap memory by supplying a crafted GetNamedVariableListAttributesResponse itemId argument to the MmsMapping_varAccessSpecToObjectReference function in the MMS Protocol Workflow. A public proof-of-concept exploit has been released and is available for download. The vulnerability has not yet been patched; the project was notified via GitHub issue #599 but has not responded at time of analysis. No active exploitation is confirmed by CISA KEV, though the publicly available PoC meaningfully elevates near-term risk.
Command injection in MIMICLab mcp-pdf-vision 1.1.0 allows a local low-privileged attacker to execute arbitrary OS commands by supplying crafted values to the pdfPath or sessionId arguments of the load_pdf function in src/index.ts. The CVSS 4.0 score of 4.8 (Medium) reflects a local-only attack surface with limited confidentiality, integrity, and availability impact; no scope change to subsequent systems is possible. A proof-of-concept exists per the E:P exploit maturity indicator in the CVSS 4.0 vector, and no patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue.
Command injection in slidev-builder-mcp 2.1.0 allows local low-privilege users to execute arbitrary OS commands by passing shell metacharacters in the `outputDir` argument to the `generateChart` function of the generateAssets Tool. The attack is confined to local access only (CVSS 4.0 AV:L), and the CVSS 4.0 E:P modifier confirms publicly available proof-of-concept code exists. No vendor patch has been released as the project has not responded to the disclosure; no confirmed active exploitation (not in CISA KEV) has been identified at time of analysis.
Command injection in MauricioMilano coder-api (all versions through 1.1.0) allows a local, low-privileged attacker to execute arbitrary OS commands via the createProject function in the Projects Endpoint. The vulnerability stems from unsanitized input passed to a system command in src/core/projects.ts, enabling an attacker with local access to manipulate project creation inputs and achieve code execution in the application's runtime context. A proof-of-concept exploit exists (CVSS 4.0 E:P), no patch has been released, and the project maintainer has not responded to the responsible disclosure report.
Command injection in andreahaku llm_memory_mcp allows local attackers with limited privileges to execute arbitrary OS commands by manipulating the `hash` argument passed to the `auto.capture` function in `GitHooksManager.ts`. All commits up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0 are affected, and a proof-of-concept is indicated as available via the CVSS 4.0 E:P enrichment. No patch has been released, and the project maintainer has not responded to the coordinated disclosure reported via GitHub issue.
Path traversal in abrinsmead mindpilot-mcp 0.5.0 allows local low-privileged users to escape intended directory boundaries by supplying crafted path traversal sequences as the ID argument to the HistoryService component, enabling unauthorized file reads and writes within the process's permission scope. Publicly available proof-of-concept exploit code exists (E:P per CVSS 4.0 vector), and the vendor has not responded to coordinated disclosure via GitHub issue #24. No patch is available at time of analysis.
Path traversal in astralisone's rive-mcp-server-core MCP server allows local low-privileged users to escape the intended directory boundary by supplying crafted sequences in the `libraryId` argument of the importRiveFile flow, enabling unauthorized read and partial write access to files on the host system. All commits up to db1d0cc4cd52589116360428b7504fd0ca748b3e of the rolling-release project are affected, with no vendor patch issued and no vendor response to disclosure at time of analysis. A proof-of-concept exploit exists (CVSS 4.0 E:P), though no confirmed active exploitation (CISA KEV) has been reported.
Path traversal in aaronsb memory-graph affects three JsonMemoryStorage functions - createDomain, getMemories, and saveMemories - in src/tools/memoryTools.ts, enabling local low-privilege attackers to escape the intended storage directory and read or write arbitrary files accessible to the process. All rolling-release versions through commit 5cfd238 are affected with no vendor patch issued; the project was notified via GitHub issue #14 but has not responded. A proof-of-concept exploit is publicly available (CVSS 4.0 E:P), and no confirmed active exploitation is listed in CISA KEV.
Path traversal in Hulupeep mcp-ui-probe 0.1-0.2.0 allows a local authenticated user to read, write, or delete arbitrary files by manipulating the journeyId or filename arguments passed to the Journey and Usage API functions in JourneyStorage.ts. The CVSS 4.0 E:P supplemental metric confirms publicly available proof-of-concept exploit code exists, raising real-world risk above what the moderate base score alone suggests. No vendor patch is available; the project has not responded to the responsible disclosure submitted via GitHub issue.