evernote-mcp-server openBrowser Command Injection Privilege Escalation Vulnerability (CVE-2025-12489)

This vulnerability allows local attackers to escalate privileges on affected installations of evernote-mcp-server.

An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the openBrowser function.

The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call.

An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account.

evernote-mcp-server has issued an update to correct this vulnerability.

I am one of the editors here at www.systemtek.co.uk I am a UK based technology professional, with an interest in computer security and telecoms.