EUVD-2026-89361
GHSA-6h3w-5484-rrpw
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Local, opt-in config tool and a deferred service-restart trigger give AV:L/AC:H/PR:L; code runs as the service user yielding full C:H/I:H/A:H (I raise A over the vendor's A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.
AnalysisAI
OS command injection in mbailey VoiceMode through version 8.10.1 lets an authenticated local attacker who can reach the update_config MCP tool or the 'voicemode config set' CLI persist an arbitrary shell payload that executes as the service user on the next Whisper or serve service start (or reboot). The injected value is written verbatim into ~/.voicemode/voicemode.env, which the start scripts load with bash 'source', so constructs such as $(...) or backticks run even inside double quotes because bash performs command substitution there. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to invoke the update_config MCP tool or the 'voicemode config set' CLI with an attacker-controlled value. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but low-urgency issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade VoiceMode to v8.10.2 or later, which is the vendor-released patch; the fix commit is c1cef85333fca497c46a11950911d10123f61e48 and the release is at https://github.com/mbailey/voicemode/releases/tag/v8.10.2, with details in the advisory https://www.traceforce.ai/security-advisories/cve-2026-79535 (GHSA-h97v-r3jw-cf6f). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in the create_file tool served by the 03-lovepreetSingh MCP application's /api/mcp route lets remote, una
Authenticated attackers holding Subscriber-level (or higher) WordPress accounts can escalate themselves to Administrator
Server-side request forgery in fast-mcp-telegram prior to version 30.1 allows an authenticated MCP client (CVSS PR:L) to
OS command injection in the Git Remove MCP Tool of 0xshariq github-mcp-server (all revisions up to commit 52e764a7d66eac
A directory traversal flaw in mark3labs mcp-filesystem-server v0.11.1 lets a caller write files outside the server's con
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today