EUVD-2026-54869
GHSA-92x2-9gq9-2w2v
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low-privilege requirement confirmed by description and CVSS 4.0 source; no scope change and limited CIA impact consistent with partial command execution.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component run_openlane/view_waveform. The manipulation of the argument design_name/vcd_file leads to command injection. Local access is required to approach this attack. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in NellyW8 MCP4EDA 1.0.0 allows a local low-privileged attacker to execute arbitrary OS commands by manipulating the design_name or vcd_file arguments passed to the run_openlane or view_waveform components. The vulnerability arises from unsanitized argument handling and was reported to the maintainer via GitHub issue #3, but has received no vendor response to date. A proof-of-concept exploit exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been identified.
Technical ContextAI
MCP4EDA (cpe:2.3:a:nellyw8:mcp4eda:*:*:*:*:*:*:*:*) is a tool in the electronic design automation (EDA) space, likely providing an MCP (Model Context Protocol) interface to EDA workflows such as OpenLane ASIC flows and waveform viewing. The affected functions run_openlane and view_waveform appear to construct shell commands incorporating user-supplied arguments (design_name and vcd_file respectively) without adequate sanitization or escaping. CWE-77 (Improper Neutralization of Special Elements used in a Command) is the root cause class - the application concatenates attacker-controlled strings directly into a command interpreter invocation, enabling injection of arbitrary shell metacharacters (e.g., semicolons, pipes, backticks). This is a classic shell injection pattern common in EDA tooling that bridges Python/scripting layers to underlying Unix command execution.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the GitHub issue report (#3 at https://github.com/NellyW8/MCP4EDA/issues/3). As a compensating control, restrict local shell access to the host running MCP4EDA to only trusted users, as the attack requires an existing local session with low privileges. Input validation should be applied to design_name and vcd_file arguments - specifically, reject or escape shell metacharacters (semicolons, pipes, backticks, dollar signs) before they are interpolated into any command string. If MCP4EDA is used in a shared or multi-user environment, consider running it inside a container or sandbox (e.g., Docker with a restricted seccomp profile) to limit the blast radius of injected commands. Organizations requiring the functionality should monitor the GitHub repository for a patched release.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today