radare2-mcp EUVD-2026-25314

Exploitation requires that the radare2-mcp JSON-RPC/MCP interface be reachable by the attacker and that a request parameter reaches r2_cmd_str() - the specific sink named in the CVE. On vulnerable builds (1.6.0 and earlier) radare2's cfg.sandbox is effectively off for this path, so shell metacharacters (';', '|', '&', backticks, '$()') in user-controlled JSON-RPC input bypass the command filter and execute. No authentication is required (PR:N) and no user interaction is needed (UI:N). The primary LIMITING factor is network exposure: MCP servers are commonly launched as a local stdio process tied to a single client, so an instance not bound to a network-reachable address is not remotely exploitable; the CVSS AV:N rating assumes the interface is exposed. On patched builds exploitation additionally requires an operator to have deliberately disabled the sandbox via '-g all'.

The signals are internally consistent for a high-severity but not yet mass-exploited issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA all High, score 9.3) describes trivial, unauthenticated, network-reachable total compromise, and SSVC reinforces this: Automatable=yes and Technical Impact=total. Against that, EPSS is only 0.27% (51st percentile) and the item is NOT in CISA KEV, and SSVC exploitation status is 'poc' rather than 'active' - meaning working exploit code exists but broad in-the-wild campaigns are not confirmed. The most important caveat is exposure: MCP servers are frequently run as a local stdio process bound to a single AI client rather than a public network service, so real-world attack surface depends heavily on whether the JSON-RPC interface is actually reachable over the network - the CVSS AV:N assumes it is. Bottom line: where radare2-mcp is network-exposed this is a genuine, easy-to-exploit RCE that should be patched immediately; the low EPSS reflects small deployment footprint and POC-not-yet-weaponized status, not low technical severity.

An attacker who can reach an exposed radare2-mcp JSON-RPC endpoint sends a request whose parameter embeds shell metacharacters (e.g. appended with ';' or '|' plus a command); the payload slips past the application command filter and is executed by r2_cmd_str() with the privileges of the radare2-mcp process, yielding a reverse shell or arbitrary command execution. Because publicly available POC exists and SSVC rates the attack automatable, this can be scripted against any discoverable instance without user interaction or credentials.