An unauthenticated remote code execution vulnerability in ChatGPTNextWeb NextChat up to version 2.16.1 allows attackers to achieve full system compromise via arbitrary OS command injection.

This vulnerability involves improper authorization and missing authentication via CWE-285 and CWE-306, where an unauthenticated remote attacker can invoke the addMcpServer Next.js Server Action to execute arbitrary OS commands on the underlying server.

A successful exploit grants an attacker full operating system command execution as the server process user, leading to a total loss of confidentiality, integrity, and availability. Attackers can exfiltrate sensitive environment variables such as API keys and secrets, persist unauthorized access, or disrupt critical operations. Although the base CVSS score is 7.3, the technical reality of unauthenticated remote code execution elevates the practical risk to critical status, threatening severe reputational and financial damage.

Immediate Action: Restrict network access to the application using a Web Application Firewalls (WAF) or isolate the instance until an official vendor patch is released.

Proactive Monitoring: Monitor server process spawn events, unexpected child processes, and unusual outbound network connections originating from the NextChat deployment.

Compensating Controls: Deploy a Web Application Firewalls (WAF) rule to block HTTP POST requests containing unauthorized Next-Action headers targeting MCP server actions.

Public Exploit Available: Yes, a public proof-of-concept and detailed technical write-up exist via the referenced GitHub issue.

Given the severity of unauthenticated remote code execution, IT and security teams must treat this advisory with extreme urgency. Administrators should apply compensating network controls immediately and monitor closely for updates from the vendor to patch this vulnerability.