Mcp Pdf Vision
Monthly
Command injection in MIMICLab mcp-pdf-vision 1.1.0 allows a local low-privileged attacker to execute arbitrary OS commands by supplying crafted values to the pdfPath or sessionId arguments of the load_pdf function in src/index.ts. The CVSS 4.0 score of 4.8 (Medium) reflects a local-only attack surface with limited confidentiality, integrity, and availability impact; no scope change to subsequent systems is possible. A proof-of-concept exists per the E:P exploit maturity indicator in the CVSS 4.0 vector, and no patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue.
Command injection in MIMICLab mcp-pdf-vision 1.1.0 allows a local low-privileged attacker to execute arbitrary OS commands by supplying crafted values to the pdfPath or sessionId arguments of the load_pdf function in src/index.ts. The CVSS 4.0 score of 4.8 (Medium) reflects a local-only attack surface with limited confidentiality, integrity, and availability impact; no scope change to subsequent systems is possible. A proof-of-concept exists per the E:P exploit maturity indicator in the CVSS 4.0 vector, and no patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue.