win-cli-mcp-server CVE-2025-11202

Exploitation requires an attacker to be able to supply a command name/string to the server's command-execution path so it reaches resolveCommandPath, which passed the value unsanitized into where "${command}" executed through a shell - shell metacharacters (" & | etc.) escape the intended command and run attacker-controlled code as the service account. Limiting factors: the server is a Model Context Protocol server that is frequently run locally over stdio for a single client, so true remote-unauthenticated reach depends on it being deployed with a network-facing transport or on the attacker controlling the command string the AI client forwards; the flaw bypasses the project's command-whitelist security model because the injection occurs within path resolution. Affected versions are pre-0.2.0; upgrading to 0.2.0 (which removes resolveCommandPath) remediates it.

The CVSS 3.0 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a classic unauthenticated remote OS command injection (CWE-78) with full confidentiality, integrity, and availability impact, which on its face is a top-priority finding. The source-commit evidence strongly corroborates the technical severity: the removed resolveCommandPath function interpolated an untrusted string directly into a shell command (where "${command}" via execAsync), a textbook injection primitive. However, several real-world risk signals are MISSING from the input and should temper urgency: there is no EPSS score, the vulnerability is NOT in CISA KEV, and no public exploit (POC) is referenced - so this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. The biggest tension is between the CVSS AV:N/PR:N rating and the product's real deployment model: win-cli-mcp-server is a Model Context Protocol server that is very commonly run locally over stdio for a single AI client, in which case 'remote unauthenticated' network exploitation is far narrower than the 9.8 implies and would typically require the server to be exposed over a network transport (e.g., SSE/HTTP) or require an attacker to influence the command string the client submits. Net: technically a genuine RCE and worth prompt patching for anyone running this server, but its aggregate real-world risk is bounded by a niche footprint and no evidence of exploitation - verify your transport exposure before treating it as an internet-facing 9.8.

An attacker able to reach the win-cli-mcp-server command-execution interface submits a 'command' value containing Windows shell metacharacters (e.g., cmd.exe" & calc.exe & "). When resolveCommandPath builds where "<command>" and runs it through the shell, the injected payload breaks out and executes arbitrary commands in the context of the service account. No public exploit is referenced, but the fix commit publicly reveals the exact vulnerable code path, lowering the bar to weaponize.