An HTTP interface in idachev mcp-javadc accepts a jarFilePath argument that is passed directly to the operating system’s command line, creating a classic OS command injection flaw identified by CWE-77. The vulnerability also falls under the broader Command Injection category (CWE-78), allowing an attacker to inject arbitrary shell commands. Successful exploitation grants the attacker the ability to execute any command on the host, potentially leading to full system compromise, data theft, or denial of service.

The flaw exists in idachev mcp-javadc releases up to version 1.2.4. It is triggered through a web‑based HTTP endpoint that is exposed to network traffic, meaning any deployment of the affected application, regardless of underlying operating system, is susceptible.

With a CVSS score of 6.9 the vulnerability signals moderate severity, but the publicly available proof‑of‑concept means an attack can be launched remotely by sending crafted requests. The lack of an EPSS score and absence from the CISA KEV catalog do not reduce the risk; the operator still faces the possibility of local or remote compromise without requiring authenticated access or privileged rights. The architecture allows direct command execution, making the threat highly actionable for a motivated attacker.