The automagik-genie 2.5.27 MCP Server contains a command‑injection flaw in the readTranscriptFromCommit routine. By calling the view_task endpoint, an attacker can inject arbitrary shell commands that are executed on the server when the application retrieves data from an external FORGE_BASE_URL. This yields full control over the host, compromising confidentiality, integrity and availability, and is a classic example of an OS command injection vulnerability: CWE‑78.

Only the automagik‑genie 2.5.27 MCP Server is listed as vulnerable. No other vendor or product versions are supplied, and the affected release is precisely 2.5.27.

The CVSS score of 8.1 indicates high severity. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, suggesting limited current exploitation activity. The likely attack vector is remote network access to the MCP Server’s view_task endpoint, which can be reached from any network location that can communicate with the server. An attacker can exploit this flaw by sending a crafted view_task request with a malicious FORGE_BASE_URL, resulting in arbitrary command execution on the host.