A flaw in MODSetter SurfSense allows an attacker to inject arbitrary system commands through the /api/search-source/connectors/mcp/test endpoint. The vulnerability is categorized under command injection weaknesses: CWE-74 for improper input validation that leads to command concatenation and CWE-77 for unsanitized command execution. This flaw enables a remote attacker to send specially crafted requests that cause the server to execute arbitrary shell commands, potentially exposing full control over the host machine.

MODSetter SurfSense versions up to and including 2.0.3 are affected. No information was provided about fixes in later releases, so any installation of 2.0.3 or earlier should be treated as vulnerable until a vendor update becomes available.

The CVSS score of 5.3 denotes a moderate severity, but the vulnerability can be leveraged remotely without authentication and there are publicly available proofs of concept. The EPSS score is 1%, and the issue is not listed in the CISA KEV catalog, yet the presence of a remote command injection and public exploit code elevates the operational risk to a high priority for exposed services.