Garding the Godot MCP server, a function named executeOperation accepts a projectPath parameter and forwards its value directly to the operating system’s exec interface. This lack of sanitization permits an attacker to inject arbitrary shell metacharacters, such as $(command) or &calc, yielding execution of any command under the privileges of the MCP server process. The vulnerability aligns with CWE-78, representing an unsanitized use of external input to control executable code. The result is that any operator or tool that supplies a projectPath—such as create_scene or load_sprite—can become a conduit for arbitrary code execution, compromising the confidentiality, integrity, and availability of the target machine.

The affected vendor is Coding‑Solo, producing the Godot MCP product. Versions before 0.1.1 of the Godot MCP server contain this flaw. The issue has been addressed and patched in the 0.1.1 release, so systems running that version or later are no longer vulnerable.

The CVSS score of 7.8 indicates a high-impact vulnerability, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not cataloged in CISA’s KEV list. Attackers would need to interact with the MCP API or a tool that passes projectPath data, indicating a remote or local exploit vector depending on the configuration of the MCP server. Because the flaw allows execution with the server’s privileges, the potential impact is severe if the server runs with elevated rights. The overall risk remains considerable due to the serious impact, though the likelihood of exploitation is presently low.