CVE-2026-4192 | AvinashBole quip-mcp-server 1.0.0 src/index.ts setupToolHandlers command injection

A vulnerability was found in AvinashBole quip-mcp-server 1.0.0. It has been declared as critical. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection.

This vulnerability is listed as CVE-2026-4192. The attack may be performed from remote. In addition, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.