An OS command injection vulnerability in the Sunwood-ai-labs command-executor-mcp-server version 0.1.0 allows unauthenticated remote attackers to achieve full host compromise.

This is an OS command injection flaw caused by improper neutralization of special elements within the execute_command function in src/index.ts. The application performs an insufficient allowlist check by only evaluating the first space-delimited token of the input string before passing the entire unmitigated command to a shell, requiring no authentication.

A successful exploitation of this vulnerability can lead to a total compromise of the host system. Attackers can read sensitive files, modify system state, or terminate critical processes, resulting in severe data loss, operational downtime, and reputational damage. While the assigned CVSS score is 7.3, the severity is amplified by the remote unauthenticated vector and the presence of a public proof-of-concept, enabling full system control.

Immediate Action: Restrict network access to the MCP server immediately, and ensure it is not exposed to untrusted clients or the public internet until a vendor patch is released.

Proactive Monitoring: Monitor system and process logs for anomalous subprocess creation, unexpected shell commands, or unauthorized execution attempts originating from the MCP interface.

Compensating Controls: Deploy a Web Application Firewall or network segmentation rules to block inbound requests containing shell metacharacters, and run the MCP server under a dedicated, low-privilege service account.

Public Exploit Available: Yes, a published proof-of-concept exists per the referenced GitHub issue.

Organizations utilizing the Sunwood-ai-labs command-executor-mcp-server must treat this flaw with high urgency despite the lack of a formal vendor patch. Immediate risk mitigation requires isolating the server from untrusted networks, restricting allowed command configurations, and running the service with minimal user privileges to prevent total host takeover.