An OS command injection vulnerability in AgentDeskAI browser-tools-mcp allows remote attackers to execute arbitrary code on macOS systems, posing a critical risk to system integrity.

The application improperly neutralizes user-supplied path data before interpolating it into a shell command that executes AppleScript via osascript. This allows an unauthenticated remote attacker to inject shell metacharacters and execute arbitrary OS commands through the browser-connector.ts component.

Successful exploitation of this vulnerability permits unauthorized remote code execution on the host machine with the privileges of the application process. This could lead to full system compromise, including unauthorized data access, modification of system configurations, or the deployment of persistent malware. Given the CVSS score of 7.3, this flaw represents a significant risk to organizational infrastructure, particularly for deployments exposed to untrusted networks.

Immediate Action: No official patch is currently available. Administrators should immediately bind the service to localhost (e.g., set SERVER_HOST=127.0.0.1) to prevent external access and disable the autoPaste feature in the application settings.

Proactive Monitoring: Review system logs for unexpected osascript process executions or suspicious file modifications in temporary directories. Monitor network traffic for anomalous POST requests to /capture-screenshot or /extension-log and WebSocket traffic to /extension-ws.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress proxy to filter incoming requests and block inputs containing shell metacharacters such as single quotes, semicolons, and backticks. Ensure that the service is isolated from the public internet using network-level access controls.

Public Exploit Available: Yes, a functional proof-of-concept exists and is detailed in the researcher write-up linked in the project's GitHub issues (Issue #232).

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability poses an immediate threat to any macOS system running the affected software. Security teams must prioritize restricting network access to the service and disabling the vulnerable functionality until the vendor provides a secure update. Failure to apply these mitigations may allow attackers to gain unauthorized control over the host environment.