A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0. This issue affects the function launch_vmd_gui_tool of the file mcp_server.py of the compo…

A critical command injection vulnerability (CVE-2026-7215) has been discovered in egtai gmx-vmd-mcp up to version 0.1.0. The vulnerability affects the launch_vmd_gui_tool function in mcp_server.py of the VMD Launch Handler component. Attackers can exploit this flaw by manipulating the structure_file/trajectory_file arguments to achieve command injection. The vulnerability can be exploited remotely and a public exploit is available. The project maintainers have been notified through an issue report but have not yet responded to the vulnerability disclosure.