The vulnerability arises when the MCP tool accepts command parameters that contain shell metacharacters; these values – including target, port, project_path, and project_name – are passed to asyncio.create_subprocess_shell. This exposes the MCP server process to arbitrary OS command execution. The flaw is a classic OS Command Injection (CWE‑78) that allows an attacker to run any command as the MCP server user, granting full system compromise.

Any deployment of esp‑mcp that includes the code from commit 28afddf is affected. The vendor horw provides the MCP tool, typically running as a server on embedded devices such as Raspberry Pi. No specific product version string is supplied, but any installation that has not been updated past this commit remains vulnerable.

The CVSS score of 8.5 reflects high severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploits yet. The likely attack vector is remote—the attacker would send specially crafted MCP commands through the exposed server interface. Successful exploitation would execute arbitrary commands with MCP server privileges, permitting full compromise of the host and connected devices.