The vulnerability is an OS command injection flaw in the input_text function of XixianLiang HarmonyOS‑mcp‑server. By manipulating the \"text\" argument, an attacker can cause the server to execute arbitrary operating‑system commands. The weakness is represented by CWE‑77 and CWE‑78 and can lead to full system compromise if exploited, providing the attacker’s privileges on the server.\n

XixianLiang HarmonyOS‑mcp‑server version 0.1.0

This vulnerability carries a CVSS score of 5.3, indicating moderate risk, and an EPSS score of less than 1 %, suggesting very low probability of being seen in the wild at present. Because the flaw permits remote execution of arbitrary commands via the input_text endpoint, an attacker who can reach the server over the network could inject commands and gain the privileges of the running service. The existence of publicly available exploits and the lack of any current mitigation in the CISA KEV catalog underscore the potential for exploitation, though the low EPSS score mitigates immediate threat. The vulnerability could be leveraged to compromise the host or pivot to other services if the server runs with elevated privileges. Existing security controls such as limiting network exposure and enforcing least‑privilege execution can reduce the risk.