An attacker can exploit a flaw in the Nmap Command Handler of PhialsBasement's nmap-mcp-server; the handler uses child_process.exec without proper input validation, leading to command injection. This permits remote execution of arbitrary operating‑system commands via the vulnerable interface. The result is a full compromise of confidentiality, integrity, and availability on the affected host.

The vulnerability affects the PhialsBasement nmap-mcp-server component. All releases up to and including the commit bee6d23547d57ae02460022f7c78ac0893092e38 are impacted. The fix is provided by the commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. Because the project uses a rolling‑release model, the exact version number is not publicly listed, but any running instance prior to the patch is susceptible.

The CVSS score of 5.3 places this vulnerability in the moderate range, whereas the EPSS score of less than 1% indicates a very low probability of exploitation at the moment. It is not listed in the CISA KEV catalog. The likely attack vector is remote, gained through authorized API calls or exposed CLI endpoints in the service. An attacker exploiting this flaw can achieve full command execution, which effectively translates to remote code execution on the host machine.