LangBot's MCP configuration allows an authenticated user to alter the STDIO MCP server settings, which directly spawns a server-side subprocess based on user-provided command and arguments. This flaw permits arbitrary command execution with the privileges of the LangBot service, exposing the system to data disclosure, modification, and potential service disruption. The vulnerability is a classic OS command injection, identified by CWE-77, and is exploitable whenever a user can access the MCP configuration interface.

All instances of the LangBot application version 4.10.7 and earlier, built by langbot-app. Any user who can register or obtain an account on the platform is potentially able to trigger the vulnerable configuration pathway.

The CVSS score of 8.8 indicates high severity, with the primary impact being remote code execution. Although the EPSS score is not available, the absence of a defined KEV listing does not diminish the risk; the flaw remains severe due to the authentication requirement and lack of mitigation in current releases. Exploitation requires only that an attacker obtains or signs up for an account, making the threat vector accessible to a broad range of adversaries.