win-cli-mcp-server Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in win-cli-mcp-server. This issue arises in the resolveCommandPath method, where user-supplied strings are not properly validated before being used in system calls. As a result, attackers can execute arbitrary code on the affected system, using the service account's privileges. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running under the service account's privileges.

Remediation

win-cli-mcp-server has released a patch for this vulnerability. Users can refer to the official GitHub repository for details on the update.