A vulnerability was found in AvinashBole quip-mcp-server 1.0.0. It has been declared as critical. Affected by this vulnerability is the function
setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection.
This vulnerability is listed as CVE-2026-4192. The attack may be performed from remote. In addition, an exploit is available.
The project was informed of the problem early through an issue report but has not responded yet.
