A critical OS command injection vulnerability in PolarVista xcode-mcp-server 1.0.0 allows unauthenticated remote attackers to execute arbitrary system commands with the privileges of the server process.

The application unsafely interpolates user-supplied arguments into shell commands within the build_project and run_tests functions in src/index.ts. Because these functions do not neutralize shell metacharacters before executing them via child_process.exec, an unauthenticated attacker can inject arbitrary commands.

Successful exploitation grants an attacker full control over the host system, leading to the potential theft of sensitive source code, environment variables, or other stored data. The ability to execute arbitrary commands poses a severe risk to system integrity and availability, as attackers could modify application logic, install persistent backdoors, or disrupt critical build services. While the CVSS score is 7.3, the potential for full host compromise and the existence of public proof-of-concept material elevate the operational risk significantly.

Immediate Action: As no vendor patch is currently available, you must disable the build_project and run_tests tools immediately if the MCP server is accessible to untrusted users.

Proactive Monitoring: Review system logs for anomalous child processes spawned by the Node.js server, specifically looking for unexpected calls to shell utilities like xcodebuild or suspicious command arguments containing shell metacharacters.

Compensating Controls: Deploy a Web Application Firewall or a similar request-filtering layer to inspect and block incoming requests that contain shell metacharacters, such as semicolons or redirection operators, within the MCP tool arguments.

Public Exploit Available: Yes, a functional proof-of-concept is documented in the research write-up hosted on GitHub.

Given the ease of exploitation and the critical nature of command injection, users are strongly advised to restrict access to the affected MCP server instance until a formal security update is released. If the functionality provided by the build_project and run_tests tools is not strictly required, disabling these components is the only effective way to neutralize this threat at this time.