An OS command injection flaw exists in the processing of MCP config objects because a user‑supplied string is not validated before being used in a system call. An attacker can take advantage of this to execute arbitrary commands in the context of the running MCP Manager process, achieving a sandbox escape. The consequence is compromise of confidentiality and integrity of the host at medium integrity level.

MCP Manager for Claude Desktop, the desktop management application, is affected. No specific version range is available in the CNA data, so all installed copies of the product are potentially vulnerable.

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of less than 1 percent and the need for user interaction (the victim must visit a malicious page or open a malicious file) imply a low to medium likelihood of exploitation. This vulnerability is currently not listed in the CISA KEV catalog. The likely attack vector is impersonation via malicious content that requires user action to trigger the command injection.