This vulnerability allows an attacker to execute arbitrary operating‑system commands on the BlinkO server through the MCP server creation function. By specifying arbitrary command strings and arguments, an attacker who can initiate a connection test can trigger the execution of those commands. The flaw maps to CWE‑78, which describes operating‑system command injection and results in a full remote code execution vector. The attacker could compromise confidentiality, integrity, and availability of the affected system, potentially gaining administrative control over the host.

The affected product is blinkospace BlinkO. All releases prior to version 1.8.4 are vulnerable, as the bug was patched in 1.8.4. Users running any earlier build, such as 1.8.3 or earlier, are at risk.

The CVSS score is 8.6, indicating high severity. The EPSS score is below 1 %, which suggests a low probability that an exploit will appear in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw can be leveraged remotely by anyone with administrative access to the BlinkO’s MCP interface. Attack requires authenticating as an administrator and invoking the server creation function, after which the specified command executes with the service’s privileges. Given the high impact and available easy path for exploitation, the vulnerability warrants immediate remediation.