A critical command injection vulnerability in INQUIRELAB mcp-bridge-api allows unauthenticated attackers to achieve remote code execution on the underlying host.

The application is susceptible to command injection (CWE-77) and broader injection flaws (CWE-74). This allows an unauthenticated attacker to inject malicious commands into system processes.

Successful exploitation allows for complete compromise of the host system, including unauthorized data access, lateral movement within the network, and potential system destruction. The CVSS score of 7.3 underscores the high risk posed to the confidentiality, integrity, and availability of the server hosting the API.

Immediate Action: As no specific patch version is documented, users should monitor the official INQUIRELAB repository for security updates and restrict access to the API.

Proactive Monitoring: Inspect server logs for suspicious system calls or unexpected processes spawned by the API service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common command injection patterns.

Public Exploit Available: Unknown

Due to the severity of command injection, administrators should isolate the affected service from public networks until a formal fix is released by the vendor. Rigorous input validation and the principle of least privilege should be applied to all API interactions to minimize the attack surface.