EUVD-2026-44845
GHSA-84x8-v67g-jc27
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable management interface accepting arbitrary commands yields AV:N/AC:L/PR:N/UI:N with full RCE impact (C/I/A:H); scope unchanged as code runs within the Fay service.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the Fay service.
AnalysisAI
Remote code execution in xszyou Fay 4.3.1 lets an unauthenticated remote attacker reach the publicly exposed MCP (Model Context Protocol) management interface and register an MCP STDIO server with attacker-chosen commands, which the service then executes on the host. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-authentication, low-complexity exploitation. There is no public exploit identified at time of analysis; EPSS is modest at 0.61% (45th percentile), and this CVE is part of a broader MCP-ecosystem supply-chain advisory published by ox.security.
Technical ContextAI
Fay is an open-source AI digital-human / conversational agent framework (xszyou/Fay on GitHub) that integrates with MCP, an emerging protocol for connecting AI agents to external tools and data sources. MCP supports a STDIO transport in which the host launches a local child process (server) and communicates over standard input/output; the command and arguments used to spawn that process are configuration-controlled. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): Fay's MCP server-management logic accepts the STDIO server command and parameters from the exposed management interface without authentication or validation, so untrusted input is turned directly into a process-execution primitive. Because the command string is attacker-supplied and then executed by the service, this is effectively command/code injection by design of the unprotected management endpoint. The provided CPE (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not usefully identify the product beyond the CVE description itself.
RemediationAI
No vendor-released patch version is identified in the provided data, so the primary compensating control is to eliminate exposure of the MCP management interface: do not bind it to public or untrusted networks, restrict it to localhost, and place any required remote access behind strong authentication and a reverse proxy or firewall allowlist (trade-off: legitimate remote administration must be re-routed through the authenticated path). Because the vulnerability is registration of arbitrary MCP STDIO server commands, disable or block the MCP STDIO server configuration/management functionality if it is not required (trade-off: loses dynamic MCP tool provisioning), and run the Fay service under a low-privilege, sandboxed account so that any command execution is contained (trade-off: does not stop RCE, only limits blast radius). Monitor the GitHub repository at https://github.com/xszyou/Fay for a fixed release and upgrade as soon as one is published, and consult the ox.security advisory (https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-30618) for updates. Do not apply an invented version number - validate the exact patched release against the vendor before relying on it.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today