mcp-code-review-server CVE-2026-7628

Q: What is the CVSS score of CVE-2026-7628?

CVE-2026-7628 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-26787 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-02 cna@vuldb.com

Command Injection

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 02, 2026 - 12:32 vuln.today

Analysis Generated

May 02, 2026 - 12:32 vuln.today

EUVD ID Assigned

May 02, 2026 - 12:22 euvd

EUVD-2026-26787

Analysis Generated

May 02, 2026 - 12:22 vuln.today

CVE Published

May 02, 2026 - 12:16 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was detected in crazyrabbitLTC mcp-code-review-server up to 0.1.0. This issue affects the function executeRepomix of the file src/repomix.ts of the component RepoMix Command Handler. Performing a manipulation results in command injection. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

AnalysisAI

Remote command injection in crazyrabbitLTC mcp-code-review-server up to version 0.1.0 allows authenticated attackers to execute arbitrary system commands via manipulation of the executeRepomix function in the RepoMix Command Handler. The vulnerability stems from unsafe use of the exec() function with unsanitized user-supplied options. Public exploit code is available, and while a fix has been proposed via pull request, the maintainer has not yet merged or released a patched version.

Technical ContextAI

The vulnerability exists in src/repomix.ts within the executeRepomix function, which constructs and executes shell commands using Node.js's child_process.exec() method. The exec() function spawns a shell interpreter to parse the command string, making it vulnerable to shell metacharacter injection. Attackers can inject shell operators (pipes, command separators, command substitution) through the options.includePaths array, which are concatenated directly into the command string without escaping. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), specifically command injection. The proposed fix (referenced in PR #5) replaces exec() with execFile(), which bypasses shell interpretation and passes arguments as an array, preventing command injection entirely.

RemediationAI

The primary fix is to upgrade to a patched version once released by the maintainer; however, as of the analysis date, no patched release exists. The vendor should immediately merge and release PR #5 or an equivalent fix that replaces child_process.exec() with child_process.execFile() and restructures the command-building logic to pass arguments as an array rather than concatenating them into a shell command string. As a temporary workaround, restrict access to the mcp-code-review-server to trusted users only, disable the executeRepomix function if not essential, or run the service in a restricted environment (container with minimal privileges, network isolation). Monitor for any pull request updates or releases. Users who cannot upgrade should review the PR #5 diff and apply the changes manually to their local installation.