A remote OS command injection vulnerability was identified in idachev mcp-javadc up to version 1.2.4. The vulnerability affects an unknown function in the HTTP Interface component, where manipulation of the jarFilePath argument leads to OS command injection. The attack can be launched remotely and a public exploit is available. The project maintainer has been notified through an issue report but has not yet responded to the disclosure.