win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability (CVE-2025-11202)

This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server.

Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the resolveCommandPath method.

The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call.

An attacker can leverage this vulnerability to execute code in the context of the service account.

win-cli-mcp-server has issued an update to correct this vulnerability. More details can be found at:
https://github.com/simon-ami/win-cli-mcp-server/commit/521b4a34190d03bde7d433d213c36357181a6d09

I am one of the editors here at www.systemtek.co.uk I am a UK based technology professional, with an interest in computer security and telecoms.