In NetForensicMCP version 2.1.0 the execAsync function in index.js is vulnerable to command injection. By manipulating the interface or protocol argument, an attacker can cause arbitrary shell commands to run with the privileges of the running process. This flaw is a classic example of Command Injection (CWE-74) and OS Command Injection (CWE-77). The vulnerability allows an attacker to execute any command on the host system, compromising confidentiality, integrity and availability of data and services.

The affected product is NetForensicMCP produced by kylecui. Version 2.1.0 is affected; no other versions or builds are listed as vulnerable. The software is distributed as an open‑source Node.js application and is available on GitHub. "

The CVSS v3 score of 5.3 indicates a moderate severity, but the remote nature of the attack and the ability to execute arbitrary commands elevate its risk. The EPSS score is not available, so current exploitation likelihood cannot be quantified, yet the public disclosure of an exploit suggests an actor could and has used the flaw. The vulnerability is not listed in the CISA KEV catalog, but the existence of a working exploit and the potential impact warrant urgent attention.