What happened
The same unprivileged /api/mcp/fetch-tools endpoint that permitted SSRF also accepts the stdio transport, which launches an attacker-supplied command with attacker-controlled arguments, giving any authenticated user command execution on the backend host.
Why it matters
A low-privileged user (or an agent steered by prompt injection) can convert a tool-fetching API into host shell access on the agent platform, escalating to backend compromise.
Attack vector
POST /api/mcp/fetch-tools, reachable by any authenticated user (lowest role), accepts the stdio MCP transport, which spawns an attacker-supplied command with attacker-controlled arguments — yielding command execution on the backend.
Affected systems
heymrun/heym < 0.0.75 (POST /api/mcp/fetch-tools stdio transport)
Mitigation
Upgrade to heym 0.0.75+. Restrict fetch-tools access to trusted users; constrain the MCP transport allowlist.