Neo.mjs contains a command injection flaw in the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server. The checkSyntax() and runPlaywrightTest() routines use caller-provided absolutePath values directly inside shell commands without proper sanitization, allowing an attacker to inject arbitrary shell commands. This weakness opens the possibility for an attacker to execute any OS command on the underlying host when an AI agent is forced to call these tools, compromising confidentiality, integrity, and availability of the system.

The vulnerability affects Klarso GmbH’s Neo.mjs product, specifically the MCP file system service module. No explicit version range is listed, so any deployment of Neo.mjs that includes the affected FileSystemService.mjs code at the time of the referenced commits is potentially vulnerable.

The analysis indicates that exploitation requires the ability to influence the AI agent to invoke the vulnerable functions, which could be achieved through client-controlled data or crafted requests. The CVSS score of 9.8 classifies the flaw as critical, and the EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation. Although not listed in the CISA KEV catalog, the command injection nature of the flaw presents a high potential impact. The availability of a patch commit (88c77fc) suggests that the vulnerability has been recognized and mitigated by the vendor.