The flaw resides in the browser-connector.ts module of AgentDeskAI browser-tools-mcp, affecting versions up to 1.2.0. Unvalidated input in an unknown processing routine allows an attacker to inject operating–system commands, resulting in remote command execution. The vulnerability is classified under CWE-77 and CWE-78 and the exploit can be triggered from a remote location. The exploit has been published and may already be used in attacks.

AgentDeskAI’s browser-tools-mcp package, specifically any deployment of the browser-tools-mcp component no newer than version 1.2.0. No further sub‑product or version details are available beyond the overall package name.

The CVSS score of 6.9 places the flaw in the high‑to‑moderate severity range, meaning a successful exploit would grant the attacker full control over system commands. An EPSS score of 2% indicates a low but non‑negligible exploitation probability; attacks remain uncommon, but the presence of a publicly available exploit introduces a real threat. Because the vulnerability can be triggered from remote connections, the risk remains significant until a patch is applied or mitigated. The lack of a KEV listing indicates that the vulnerability is not actively tracked as a high‑profile threat, but it still warrants timely action.