EUVD-2026-45393Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious .mcp.json is delivered via network (AV:N) but requires the victim to open the project (AC:H, UI:R); successful spawn executes arbitrary commands as the victim user (C:H/I:H/A:H), which the official score's Low impact ratings understate.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manipulation can lead to command injection. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Command injection in LiuMengxuan04 MiniCode 0.1.0 allows a remote attacker to execute arbitrary OS commands with the victim user's privileges by supplying a malicious project-scoped .mcp.json file. The child_process.spawn call in mcp.ts unconditionally loaded MCP server definitions from project-level .mcp.json files, meaning any repository under attacker control - or one to which the attacker contributed - could trigger arbitrary command execution when a developer ran MiniCode inside it. A public proof-of-concept exploit exists; an upstream fix (PR #37) gates project MCP config loading behind an opt-in environment variable but has not yet been merged into a released version.
Technical ContextAI
MiniCode (CPE: cpe:2.3:a:liumengxuan04:minicode:*:*:*:*:*:*:*:*) is a TypeScript CLI tool built around the Model Context Protocol (MCP), which allows configurable server processes to extend its capabilities. MCP server definitions - including the executable path and arguments - are read from JSON configuration files, including project-scoped .mcp.json files at the repository root. The vulnerable code in mcp.ts passes these user-controlled command and args values directly to Node.js child_process.spawn without first verifying that the project is trusted, satisfying CWE-77 (Improper Neutralization of Special Elements used in a Command). The PR #37 diff confirms the root cause: prior to the fix, loadEffectiveSettings() always resolved and merged the project .mcp.json alongside global settings, with no trust gate. The fix introduces a shouldLoadProjectMcpConfig() guard that requires the MINI_CODE_TRUST_PROJECT_MCP environment variable to be explicitly set.
RemediationAI
No officially released patched version is available at time of analysis - the upstream fix exists as PR #37 (https://github.com/LiuMengxuan04/MiniCode/pull/37) awaiting acceptance. The fix adds a shouldLoadProjectMcpConfig() guard requiring the MINI_CODE_TRUST_PROJECT_MCP environment variable to be set to 1, true, yes, or on before project-scoped .mcp.json files are loaded and passed to child_process.spawn. Users who can apply the patch manually from the PR should do so. As an immediate workaround, avoid running MiniCode inside any repository of unknown or untrusted origin, and manually inspect any .mcp.json present in the project root for unexpected command entries before launching MiniCode. Restricting write access to project directories that contain .mcp.json files limits the attack surface but does not address repositories cloned from untrusted sources.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today