The vulnerability resides in the runCodeReviewTool function of src/tools/codeReview.ts in kleneway awesome-cursor-mpc-server. It allows an attacker to inject arbitrary shell commands by manipulating user input, leading to remote code execution. The flaw is classified as CWE‑74 (Command Injection) and CWE‑77 (Improper Neutralization of Special Elements used in an OS Command).

The affected vendor is kleneway and the product is awesome‑cursor‑mpc‑server. All releases up to and including 2.0.1 are vulnerable when the runCodeReviewTool interface is exposed. No later releases or patches are available in the public record at the time of writing.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available implying no publicly reported exploitation behavior beyond the available exploit. The vulnerability is listed as not in KEV. The attack can be launched remotely by sending crafted input to the runCodeReviewTool endpoint. Exploitation semantics suggest that, if the server is reachable from the Internet, an attacker could execute arbitrary commands on the host. The risk is elevated by the fact that the exploit has been published and is likely usable.