EUVD-2026-88609
GHSA-cm89-cv3h-2jcf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySend crafted request to MCP connector test endpoint
-
ExploitInject shell metacharacters into command parameter
-
ExecutionExecute arbitrary OS commands as service account
-
ImpactAccess/alter host data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account (PR:L) on the target SurfSense instance and access to the MCP Connector Integration feature; the attacker sends a malicious payload to /api/search-source/connectors/mcp/test. Exploitation is remote (AV:N) with low complexity (AC:L) and no user interaction. Limiting factors: valid credentials are needed, the MCP connector feature must be reachable/configured, and the instance must be network-accessible to the attacker. No official patched version is confirmed because the vendor did not respond to disclosure. |
| Impact | Signals conflict on severity. The vendor/VulDB CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N with all impact metrics rated only Low: VC/VI/VA:L and SC/SI/SA:L) yields a modest 5.3 - yet the root weakness is CWE-77 OS command injection, which normally grants arbitrary command execution and would justify High impact. This is a likely UNDERRATING by VulDB, which routinely assigns conservative Low impact ratings; a security team should treat the realistic impact as code execution as the application service account, not a minor Low-impact issue. Mitigating the raw score: exploitation requires authentication (PR:L per the CVSS vector) and access to the MCP Connector Integration feature, and there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation. However, publicly available exploit code exists (E:P in the vector plus a public gist), lowering the barrier to opportunistic abuse. Net: this is a moderate-to-elevated risk for anyone running SurfSense exposed to untrusted authenticated users, but the niche deployment footprint and authentication requirement keep it below drop-everything priority. Note the vendor did not respond to disclosure, so no official patch is confirmed. |
| Exploit ScenarioDerived | An authenticated low-privilege SurfSense user (PR:L) sends a crafted request to /api/search-source/connectors/mcp/test that injects shell metacharacters into a parameter passed to an OS command during MCP connector testing, causing arbitrary commands to run as the backend service account. Publicly available exploit code (a GitHub gist referenced by VulDB) demonstrates the technique, so the effort to reproduce is low. Because the vector is AV:N, this can be launched remotely over the network without local access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Command injection in MODSetter SurfSense through version 2.0.3 allows an authenticated low-privilege user to execute arbitrary shell commands on the host by sending a crafted payload to the /api/search-source/connectors/mcp/test endpoint within the MCP Connector Integration component. Exploitation is remote with low complexity and no user interaction, but requires valid credentials and a reachable/configured MCP connector feature. Publicly available exploit code exists (a proof-of-concept was published to a public gist and referenced by VulDB), and the vendor was contacted about the disclosure but did not respond; no official patched version is confirmed, and the signals on severity conflict (vendor CVSS 4.0 base 5.3 versus our assessed CVSS 3.1 vector of 8.8).
RemediationAI
No vendor-released patch is identified at time of analysis: the vendor was contacted early but did not respond, so there is no confirmed fixed version to upgrade to and no upstream PR or commit referenced in the supplied data. Until a fix is published, treat the /api/search-source/connectors/mcp/test endpoint as hostile input surface and apply compensating controls: disable or remove the MCP Connector Integration if it is not operationally required (most effective, but eliminates connector testing/use), and if it is required, restrict reachability to the endpoint at the reverse proxy or firewall so only trusted administrative networks can call it (side effect: legitimate remote connector management stops working); ensure every account able to reach the feature is trusted, since exploitation requires only a low-privilege authenticated session; run the SurfSense service in a container or sandbox with a non-privileged user, read-only filesystem where possible, and no unnecessary network egress or mounted host credentials (limits command execution impact but does not prevent injection); and deploy WAF/API-gateway rules that reject shell metacharacters (; | & $ ` > < newline) in connector test parameters (bypassable via encoding; not a substitute for a patch). Monitor application and process logs for unexpected child processes spawned by the SurfSense service user, and treat any use of the public proof-of-concept at https://gist.github.com/DReazer/81504d373f4e32206dc885d3c415e278 as an indicator of attempted exploitation. Re-check the VulDB references (https://vuldb.com/vuln/411141, https://vuldb.com/cve/CVE-2026-102243) for a later vendor fix or updated version guidance before assuming the issue is resolved; do not invent version numbers - no fixed release has been confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-77 command injection flaw in SurfSense's MCP (Model Context Protocol) Connector Integration, specifically the connector test handler exposed at /api/search-source/connectors/mcp/test. MCP connectors are configured with user-supplied connection parameters, and the test endpoint is designed to validate/execute the connector - likely by constructing and running a shell command (for example, spawning a local MCP server or subprocess) with attacker-influenced input that is not neutralized for shell metacharacters, allowing injected commands to run under the SurfSense process account. The description attributes the flaw to 'unknown processing' and does not pin down the exact parameter, but the root cause class is classic OS command injection rather than deserialization or template injection. The CPE cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:* indicates the affected product is the SurfSense application itself across releases up to and including 2.0.3, with no version constraint carved out in the supplied data. Per our independent assessment, the CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable, low complexity, no user interaction, but requiring an authenticated low-privilege account (PR:L) and access to the MCP connector functionality; the vendor-submitted CVSS 4.0 vector (5.3, with low CIA and subsequent-system impacts) understates the confidentiality, integrity, and availability impact assessed here.
Know when Surfsense gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
OS command injection yields code execution as the app account, so C/I/A:H; requires an authenticated account (PR:L) but is network-reachable with low complexity, hence AV:N/AC:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB