The vulnerability resides in the quick_capture function of pyshark_mcp.py in the A‑G‑U‑P‑T‑A wireshark‑mcp project. An attacker can supply crafted input that causes the function to execute arbitrary OS commands. The flaw gives remote attackers the ability to run arbitrary code on the host, leading to full system compromise. The weakness is a classic OS command injection (CWE‑77, CWE‑78).

A‑G‑U‑P‑T‑A wireshark‑mcp is the only product listed. The project follows a rolling‑release model with no fixed version numbers for vulnerable or patched releases, so any current iteration of wireshark‑mcp is potentially affected. No additional vendor or product details are available.

The CVSS score of 6.9 indicates a moderate risk. EPSS is not available, and the vulnerability has not been listed in CISA’s KEV catalog. The attack vector is remote and the exploit code has already been posted publicly, suggesting that attackers could readily target vulnerable deployments. Until an official fix is released, the risk remains high for any exposed installation.