An OS command injection vulnerability in the quick_capture function of A-G-U-P-T-A wireshark-mcp permits unauthenticated remote attackers to achieve arbitrary code execution on the underlying host.

This is an OS Command Injection flaw (CWE-78) located in the pyshark_mcp.py source file, specifically within the quick_capture function. Unauthenticated remote attackers can supply crafted network interface inputs containing shell metacharacters that are unsafely evaluated via subprocess.Popen with shell=True.

A successful exploit of this vulnerability can lead to a total compromise of the host system running the affected software. Attackers can execute arbitrary operating system commands with the privileges of the server process, resulting in potential data theft, system modification, or complete service disruption. Although the CVSS base score is listed as 7.3, the potential for arbitrary code execution presents severe operational risks that demand immediate mitigation.

Immediate Action: Since a vendor patch is currently unavailable, administrators should disable the quick_capture tool or restrict the wireshark-mcp service exposure to trusted local-only clients.

Proactive Monitoring: Monitor system process execution logs for anomalous shell commands spawned by Python worker processes or unexpected modifications to sensitive host directories.

Compensating Controls: Deploy a Web Application Firewall or network perimeter controls to inspect and block incoming requests containing shell control characters or injection payloads targeting the application.

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced GitHub issue tracker.

Given the critical nature of remote command injection flaws and the availability of public proof-of-concept exploit details, organizations running this software must take immediate defensive action. Administrators should isolate vulnerable instances from untrusted networks and apply strict input validation or code modifications to eliminate shell execution until an official vendor update is released.