What is the CVSS score of CVE-2026-3484?

CVE-2026-3484 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of Mcp Nmap Server are affected by CVE-2026-3484?

Organizations using PhialsBasement nmap-mcp-server should be aware of moderate risk from CVE-2026-3484, a injection vulnerability rated CVSS 6.3.. A patch is available.

Is there a public PoC exploit available for CVE-2026-3484?

Yes, a public proof-of-concept exploit is available for CVE-2026-3484. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-3484?

Within 30 days: Identify affected systems running PhialsBasement nmap-mcp-server and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Mcp Nmap Server CVE-2026-3484

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-03 cna@vuldb.com

GHSA-xc68-rrqc-qgq3

Command Injection Mcp Nmap Server

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

PoC Detected

Mar 05, 2026 - 21:32 vuln.today

Public exploit code

Patch released

Mar 05, 2026 - 21:32 nvd

Patch available

CVE Published

Mar 03, 2026 - 20:16 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on mcp-nmap-server (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.1.

DescriptionCVE.org

A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_process.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. It is best practice to apply a patch to resolve this issue.

AnalysisAI

Command injection in PhialsBasement nmap-mcp-server allows authenticated remote attackers to execute arbitrary system commands through the Nmap CLI Command Handler component due to improper input sanitization in child_process.exec. Public exploit code exists for this vulnerability, and affected users should apply the available patch to remediate the risk.

Technical ContextAI

Affects Mcp Nmap Server. A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_process.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identi