Upsonic 0.71.6 allows users to create MCP tasks with arbitrary command and argument values. An allowlist exists for commands, yet certain permitted commands such as npm and npx interpret flag arguments that can be abused to execute arbitrary OS commands, bypassing the intended command restrictions. This flaw enables a malicious actor to run any command with the privileges of the Upsonic process, potentially compromising the host system fully.

The vulnerability is documented for Upsonic version 0.71.6; version 0.72.0 adds a warning but no explicit confirmation that the flaw is mitigated. Only users running 0.71.6 are definitively impacted.

Based on the description, it is inferred that an attacker who can submit MCP tasks through the exposed interface can supply arbitrary command and args fields. The vulnerability allows any such crafted task to run with the privileges of the Upsonic process, enabling full compromise. The CVSS score of 9.8 signals critical severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Since the attack requires access to the MCP task submission API, limiting network exposure or enforcing authentication can reduce the risk of exploitation.