A weakness in the Toowiredd chatgpt-mcp-server allows remote attackers to inject arbitrary operating‑system commands through an unvalidated input in the docker.service.ts component of the MCP/HTTP interface. The injection can be triggered by carefully crafted requests, enabling the attacker to execute any system command with the privileges of the running service. This results in remote code execution and compromises the confidentiality, integrity, and availability of the host system.

The vulnerability affects Toowiredd chatgpt-mcp-server versions up to and including 0.1.0. No other vendors or product versions are reported as impacted.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Nevertheless, a publicly available proof‑of‑concept exploit exists on GitHub, and the project has been notified but not yet responded, so the risk remains unmitigated. The exploit can be carried out over the network via the exposed HTTP API, making remote attackers able to achieve arbitrary command execution. The vulnerability is not listed in CISA KEV, but its public exposure calls for immediate attention.