The vulnerability resides in the handleToolCall function of the mcp-ffmpeg-helper project. An attacker who can locally interact with the tool can craft a malicious format argument that is passed directly to the operating system shell. This results in arbitrary command execution, allowing the attacker to run any commands on the host with the privileges of the process that owns the tool. The weakness is a classic OS command injection (CWE‑77) and implements an indirect command execution vector (CWE‑78).

The affected application is sworddut’s mcp‑ffmpeg‑helper version 0.1.0, 0.1.1, and 0.2.1. No further vendor or product variants are listed. Users who run these versions in an environment where the tool is exposed to local input are at risk.

The CVSS score of 4.8 indicates moderate severity, but the vulnerability is exploitable only when an attacker has local access to the system and can issue commands to the tool. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Nonetheless, because the local attacker can achieve full command execution, the risk to confidentiality, integrity, and availability is significant for any environment where the helper runs with elevated or unnecessary privileges.