Jaaz 1.0.30 contains a flaw in its MCP STDIO command execution handling. An attacker can send crafted network requests to a network‑accessible Jaaz instance, causing the service to execute arbitrary commands supplied in the request. This permits remote code execution on the host running the Jaaz service, potentially leading to full system compromise. The weakness can be classified as a command injection or improper process creation flaw.

The vulnerability impacts Jaaz 1.0.30 when the service is exposed to the network. No vendor supply details are shown, but the flaw exists only in the specific version mentioned and requires that the Jaaz service be reachable over a network.

EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 7.3, indicating a high severity, but the description indicates an unauthenticated, network‑based remote code execution with high impact on confidentiality, integrity, and availability. Because the flaw is reachable over the network without authentication, the risk is considered high and exploitation is likely if the service is exposed to untrusted users.