The vulnerability in QuantGeekDev docker‑mcp 0.1.0 and 0.2.0 allows an attacker to manipulate the project_name argument supplied to the _build_windows_command function in docker_executor.py. The function concatenates this argument into a raw shell command without any sanitization, enabling the injection of arbitrary OS commands. It is inferred that an attacker who can send a crafted request to the docker‑mcp service can therefore cause arbitrary commands to run with the privileges of the host process, leading to full system compromise, data loss, and service disruption.

Vendors affected: QuantGeekDev. Product: docker‑mcp. Insecure releases are versions 0.1.0 and 0.2.0. No other versions are known to be impacted. Administrators should confirm the version in use and whether the vulnerable function is exposed via public interfaces.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, implying no documented exploitation yet. Nevertheless, because the flaw can be triggered remotely through docker‑mcp’s public endpoints, the likely attack vector is an attacker with network access who can invoke the vulnerable endpoint and immediately achieve code execution on the host. The attack requires the ability to invoke the vulnerable endpoint but does not depend on local privilege escalation beyond that.