EUVD-2026-4492
GHSA-28qq-5f47-r5x2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted input to execAsync method
-
ExploitInject malicious system command
-
ExecutionBypass input validation
-
ImpactExecute arbitrary code as service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default configurations of gemini-mcp-tool with exposed execAsync method accepting unsanitized user input. |
| Impact | CVSS 9.8, EPSS 0.52%. Part of a wave of MCP server command injection vulnerabilities discovered through systematic auditing of the MCP ecosystem. |
| Exploit ScenarioDerived | An attacker exploits the command injection to execute arbitrary commands on the host running the Gemini MCP integration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
gemini-mcp-tool has a command injection in execAsync allowing remote code execution on systems using the Gemini AI MCP integration.
Earlier versions of this analysis (1)
Command injection in gemini-mcp-tool enables RCE via crafted MCP messages.
RemediationAI
Update the tool. Use parameterized command execution instead of shell interpolation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The gemini-mcp-tool has a CWE-78 command injection in the execAsync function, part of a pattern of command injection vulnerabilities across MCP server implementations.
Know when AI / ML gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.
Executive ViewAI
A critical remote code execution vulnerability (CVE-2026-0755) in gemini-mcp-tool allows unauthenticated attackers to execute arbitrary commands on affected systems with a CVSS score of 9.8. Any organization running gemini-mcp-tool faces immediate risk of complete system compromise, data theft, and operational disruption. Immediate action is required to identify affected assets and implement mitigation measures.
- Network segmentation: restrict gemini-mcp-tool to isolated network zones with minimal trust; 2) WAF/IDS rules: block requests containing execAsync commands and shell metacharacters; 3) Disable feature: if available, disable execAsync functionality or remote execution capabilities; 4) Access controls: implement strict authentication and IP whitelisting for any access; 5) Monitoring: deploy behavioral analytics to detect anomalous command execution; 6) Process isolation: run gemini-mcp-tool with minimal privileges and within containers with restricted capabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
MCPJam Inspector versions 1.4.2 and earlier allow unauthenticated remote code execution through missing authentication i
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Sandbox escape in Enclave JavaScript sandbox before 2.11.1. Enclave is designed for safe AI agent code execution — the e
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Er
A remote code execution vulnerability in langchain-ai/langchain (CVSS 10.0). Risk factors: public PoC available. Vendor
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
Path traversal vulnerability in RAGFlow RAG engine version 0.23.1 allows unauthenticated attackers to read arbitrary fil
WeKnora LLM framework (before 0.2.5) allows authenticated users to inject MCP stdio commands that the server executes as
OS command injection in WeKnora from version 0.2.5 allows authenticated users to execute arbitrary system commands. CVSS
Exploit-DB