In gin-vue-admin version 2.9.1 an authenticated attacker who has access to both the code‑generation endpoint and the MCP management interface can submit malicious Go source through the POST /autoCode/addFunc route. By subsequently calling POST /autoCode/mcpStart the application rebuilds and restarts its standalone MCP service, which runs with the same privileges as the web server. This chain allows the attacker to execute arbitrary operating system commands, modify backend source code or runtime logic, deploy persistent backdoors, access or alter application data, and affect other local resources that share the same privilege context. The weakness is a classic command injection flaw (CWE‑78).

The vulnerability applies to flipped‑aurora’s gin‑vue‑admin product, specifically version 2.9.1. Only deployments that keep the source directory writable, expose the online code‑generation feature, and enable the MCP build/start workflow are affected. Binary‑only releases or environments where source files are read‑only or where local build capabilities have been disabled mitigate the attack chain.

The CVSS score of 7.4 indicates a high‑severity flaw. The EPSS score is not available, so the current exploit probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack requires legitimate authentication and use of the code‑generation feature, so it is an authenticated remote web‑interface attack vector. If the vulnerable workflow is enabled, the overall impact can reach critical severity, especially when the application runs with elevated privileges.