EUVD-2026-26302Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directory/create_rule of the file src/index.ts of the component MCP Interface. The manipulation of the argument ID results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.1 is able to mitigate this issue. The patch is identified as 141335da044e53c3f5b315e0386e01238405b771. It is advisable to upgrade the affected component.
AnalysisAI
OS command injection in VetCoders mcp-server-semgrep 1.0.0 allows remote unauthenticated attackers to execute arbitrary commands via unsanitized ID arguments passed to multiple analysis functions (analyze_results, filter_results, export_results, compare_results, scan_directory, create_rule) in src/index.ts. The vulnerability stems from unsafe use of child_process.exec() which interpolates user input into shell command strings. Publicly available exploit code exists, and vendor-released patch version 1.0.1 is available.
Technical ContextAI
The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The mcp-server-semgrep project is a Model Context Protocol (MCP) server that wraps the Semgrep static analysis tool. The vulnerable code in src/index.ts directly interpolates user-supplied ID parameters into shell command invocations using Node.js child_process.exec(), which spawns a shell and interprets special characters. The patch (commit 141335da044e53c3f5b315e0386e01238405b771) replaces child_process.exec() with child_process.execFile(), which does not invoke a shell and instead passes arguments as arrays. Additionally, the patch implements validateNoShellMetacharacters() validation that blocks semicolons, pipes, ampersands, backticks, command substitution syntax (${}), redirects, and other shell metacharacters before values reach the filesystem or command invocation layers. Defensive YAML escaping was also added to the create_rule function to prevent secondary injection vectors.
RemediationAI
Upgrade mcp-server-semgrep immediately to version 1.0.1 or later. The patched version replaces all unsafe child_process.exec() calls with child_process.execFile(), eliminating shell interpretation of user input. Install via npm: npm install -g mcp-server-semgrep@1.0.1 or update your package.json and run npm update. For source-based deployments, pull commit 141335da044e53c3f5b315e0386e01238405b771 or later. No functional workarounds exist for 1.0.0; patching is the only remediation. If upgrade is delayed, implement network-level controls to restrict access to the MCP server endpoint to trusted clients only, though this does not eliminate risk if internal systems or AI agents submit untrusted analysis parameters. The patch introduces validateNoShellMetacharacters() as defense-in-depth; no configuration changes are required post-upgrade.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today