NightTrek Supabase-MCP contains a command injection flaw in the generate_types component, where inappropriate handling of the schema argument allows an attacker to inject and execute arbitrary shell commands. The weakness is captured by CWE-74 and CWE-77, indicating improper validation of user input and unsafe shell command construction. If exploited, the attacker gains the privileges of the process running Supabase-MCP, potentially compromising the host system, its services, and any data accessed by that process.

The vulnerability affects installations of NightTrek Supabase‑MCP that expose the generate_types interface. No specific product version is listed; the issue was reported against an internal commit in the project, so any build derived from that commit or later without the fix is potentially vulnerable. Organizations running Supabase‑MCP should assume all affected instances unless they can confirm a patch is applied.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available, while the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be local, meaning an attacker must already have local access or the ability to execute commands on the host to exploit this flaw. Consequently, the risk is contingent on the environment: a publicly exposed or misconfigured Supabase‑MCP with local command privileges would be at higher risk, whereas a well‑segmented environment with strict access controls may mitigate the threat. No publicly known exploits exist at this time, but lack of an official fix heightens the importance of defensive controls.