The vulnerability resides in NocteDefensor LudusMCP, specifically within the SecretDialog.showSecretDialog function. An attacker who can manipulate the Description field is able to inject arbitrary shell commands. This results in command injection, allowing the execution of arbitrary code in the context of the running process. The weakness is classified under CWE-74 and CWE-77 and carries a CVSS score of 4.8, indicating moderate severity.

Affected products include NocteDefensor LudusMCP up to version 1.0.24. All installations of the component that expose the get_credential_from_user route are vulnerable unless they have applied a fix that has not yet been released by the maintainers. No other versions or additional products are currently documented as impacted.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The command injection can be triggered from the local host, so the attack vector is local. An attacker with local access can potentially elevate privileges or compromise the host by executing arbitrary commands. Until an official patch becomes available, mitigating input validation or disabling the vulnerable function remains the most viable approach.