MiniCode-Python CVE-2026-16488

Q: What is the CVSS score of CVE-2026-16488?

CVE-2026-16488 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-47592 LOW

Command Injection (CWE-77)

2026-07-22 cna@vuldb.com

GHSA-6mqg-64h7-88w3

Python Command Injection

1.3

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Arbitrary OS command execution via subprocess.Popen warrants C:H/I:H/A:H; social engineering to open malicious project drives AC:H and UI:R, with no attacker privileges needed.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 07:56 vuln.today

Analysis Generated

Jul 22, 2026 - 07:56 vuln.today

DescriptionCVE.org

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.1.0-rc1 is able to resolve this issue. This patch is called 9d868dc2550f426c6ddf8ee98f30ffe450ca5e32. It is suggested to upgrade the affected component.

AnalysisAI

Command injection in MiniCode-Python 0.1.0 allows a remote attacker to execute arbitrary OS commands on a developer's machine by embedding malicious MCP server definitions in a project-level .mcp.json file that the tool automatically loads via subprocess.Popen in minicode/config.py. Successful exploitation requires the victim to clone or open an attacker-controlled project and invoke MiniCode-Python within it, making this a developer supply-chain style attack with high complexity and passive user interaction requirements. A public proof-of-concept is confirmed per CVSS 4.0 supplemental metric E:P and the referenced GitHub Gist; the vendor has released version 0.1.0-rc1 to resolve the issue.

Technical ContextAI

MiniCode-Python is a Python AI coding assistant that integrates external tools via the Model Context Protocol (MCP). MCP server entries in project-level .mcp.json files define command strings that the tool launches as subprocesses. Prior to 0.1.0-rc1, the load_effective_settings function in minicode/config.py unconditionally called read_mcp_config_file on the project .mcp.json path and passed the resulting server command definitions to subprocess.Popen for execution - with no user consent gate and no sanitization. CWE-77 (Improper Neutralization of Special Elements used in a Command) captures this root cause: externally supplied configuration data from a cloned project flowed directly into an OS command executor. The security comment added in the fix commit explicitly warns: 'A cloned project could define a malicious MCP server (e.g. curl | sh).' The fix restructures load_effective_settings and load_runtime_config to require explicit opt-in via --trust-project-mcp CLI flag or MINI_CODE_TRUST_PROJECT_MCP=1 environment variable before loading any project-level MCP configuration. No CPE string was supplied in the input data; affected version is confirmed as 0.1.0 from ENISA EUVD-2026-47592 and the vendor GitHub commit history.

RemediationAI

Upgrade MiniCode-Python to version 0.1.0-rc1, available at https://github.com/QUSETIONS/MiniCode-Python/releases/tag/v0.1.0-rc1 and addressed by commit 9d868dc2550f426c6ddf8ee98f30ffe450ca5e32. After upgrading, project-level .mcp.json files are disabled by default and require explicit opt-in via the --trust-project-mcp CLI flag or MINI_CODE_TRUST_PROJECT_MCP=1 environment variable - only set this flag when working with trusted, reviewed project repositories. As an interim workaround for environments that cannot upgrade immediately, avoid invoking MiniCode-Python 0.1.0 within any untrusted or unreviewed project directory, and manually audit the contents of any .mcp.json files in project roots before use; this workaround is manual, error-prone, and should not substitute for patching. No additional compensating controls were identified in the available data.