The vulnerability arises in the eqn_chart function of the fermat‑mcp package, where an attacker can supply a crafted equations argument that causes the application to inject and execute arbitrary code. This code injection flaw is the sole weakness reported, and the CVSS score of 5.3 indicates a moderate severity. Because the exploit is publicly available and can be triggered remotely without authentication, the impact is the ability to run arbitrary commands on the system hosting the service.

The affected product is abhiphile’s fermat‑mcp, encompassing all releases prior to the commit 47f11def1cd37e45dd060f30cdce346cbdbd6f0a. The project follows a rolling‑release model and does not publish explicit version numbers for affected or patched releases, so any instance of the current code base may be vulnerable.

The EPSS score of less than 1 % indicates that exploitation is currently considered unlikely, yet the vulnerability is publicly documented and an exploit is available, raising the risk for systems still running the vulnerable code. The attack vector is remote, occurring through the EQN_CHART API endpoint, and does not require authentication. As the product lacks a published fix, the only mitigation remains to stop using the vulnerable module or to explicitly shield the endpoint.