A command injection flaw has been identified in the search_username function of mcp-maigret’s src/index.ts. The vulnerability allows an attacker to inject arbitrary shell commands through the Username argument, which is then passed to the system shell without proper validation. This corresponds to CWE-74 and CWE-77 weaknesses. If exploited, the attacker can run arbitrary commands on the host, compromising confidentiality, integrity, and availability of the affected system.

The flaw exists in all releases of BurtTheCoder’s mcp-maigret up to and including version 1.0.12. Version 1.0.13 incorporates a fix that removes the unsafe command execution path. The component affected is the search_username feature within src/index.ts.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, presumably via requests to the search_username endpoint exposed by the application. The patch mitigates the risk by preventing the injection of malicious commands.