The vulnerability is an OS command injection flaw in the input_text function of XixianLiang HarmonyOS‑mcp‑server. By manipulating the "text" argument, an attacker can cause the server to execute arbitrary operating‑system commands. The weakness is represented by CWE‑77 and CWE‑78 and can lead to full system compromise if exploited, providing the attacker’s privileges on the server.

XixianLiang HarmonyOS‑mcp‑server version 0.1.0

This vulnerability carries a CVSS score of 5.3, indicating moderate risk, and an EPSS score of 15%, suggesting a moderate probability of being seen in the wild. Because the flaw permits remote execution of arbitrary commands via the input_text endpoint, an attacker who can reach the server over the network could inject commands and gain the privileges of the running service. The existence of publicly available exploits and the lack of any current mitigation in the CISA KEV catalog underscore the potential for exploitation, though the 15% EPSS score indicates a moderate probability of exploitation. The vulnerability could be leveraged to compromise the host or pivot to other services if the server runs with elevated privileges. Existing security controls such as limiting network exposure and enforcing least‑privilege execution can reduce the risk.