Description
A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-03-15
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Injection
Action: Assess Impact
AI Analysis

Impact

The vulnerability exists in the setupToolHandlers function of quip-mcp-server's src/index.ts. It allows an attacker to inject arbitrary operating‑system commands via user input, leading to remote command execution. The weakness is rooted in improper validation of arguments, matching CWE-74 and CWE-77.

Affected Systems

Affected systems are those running AvinashBole:quip-mcp-server 1.0.0. The CVE description does not list additional versions; no other variants are known from the CNA data. Therefore, any deployment of version 1.0.0 exposed to the network is susceptible.

Risk and Exploitability

The CVSS base score is 5.3, indicating moderate severity. EPSS is below 1%, suggesting the exploitation probability is currently low; it is also not present in the CISA KEV catalog. However, the attack can be performed remotely without authentication, so exposed services should be monitored. The exploit has been publicly disclosed and may be used. Without an official patch, the risk remains.

Generated by OpenCVE AI on March 16, 2026 at 22:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify that you are running quip-mcp-server 1.0.0 or any older release.
  • Check the official GitHub repository for a newer version or an advisory that addresses this issue, and upgrade if a fix has been released.
  • If no patch is available, isolate the service behind a firewall and restrict incoming connections to trusted hosts only.
  • Monitor system logs for anomalous command execution or unexpected network traffic originating from the tool.
  • Consider replacing the tool with an alternative that does not contain this vulnerability if a fix is not forthcoming.

Generated by OpenCVE AI on March 16, 2026 at 22:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 16 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Avinashbole
Avinashbole quip-mcp-server
Vendors & Products Avinashbole
Avinashbole quip-mcp-server

Sun, 15 Mar 2026 20:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title AvinashBole quip-mcp-server index.ts setupToolHandlers command injection
Weaknesses CWE-74
CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Avinashbole Quip-mcp-server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-16T20:10:09.885Z

Reserved: 2026-03-14T22:50:48.443Z

Link: CVE-2026-4192

cve-icon Vulnrichment

Updated: 2026-03-16T20:09:58.936Z

cve-icon NVD

Status : Deferred

Published: 2026-03-16T14:20:02.670

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-4192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T14:01:11Z

Weaknesses