SimpleChat EUVD-2026-93426

Requires an authenticated low-privileged account (PR:L) and TWO non-default deployment prerequisites explicitly named in the description: personal plugins must be enabled AND governance must be configured to permit MCP actions. The attack-specific trigger is omitting the top-level 'type' field in the POST /api/user/plugins payload so that _reject_non_admin_mcp_stdio skips its inspection before the type is restored from metadata, allowing a stdio MCP action to persist. Code execution only fires when the stored action tool is subsequently invoked, spawning a process under the application service identity. Limiting factors: if personal plugins are disabled or MCP governance is not permitted, the path is unreachable; exploitation also depends on the attacker holding a valid low-privilege session rather than being fully anonymous.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring only low-privileged authentication, yielding high confidentiality, integrity, and availability impact via OS command execution (CWE-78) under the application service identity. This is a genuinely serious impact (arbitrary process execution), but several signals temper widespread-exploitation urgency: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code was identified - so exploitation status is 'no public exploit identified at time of analysis.' Crucially, the description constrains exploitation to environments where personal plugins are enabled AND governance permits MCP actions, which is a non-default, operator-dependent precondition that the AC:L metric does not reflect; real-world attack complexity is effectively higher than the raw vector suggests. Priority should be treated as moderate-to-high for deployments that have explicitly enabled MCP personal plugins, and low for the default/common deployment where those features are off. Note also a version discrepancy: the description states the fix is in 0.261.031, while the supplied patch commit only bumps VERSION to 0.261.029 - verify the authoritative fixed version with the vendor advisory.

An authenticated low-privileged SimpleChat user sends a crafted POST /api/user/plugins request that omits the top-level MCP 'type' field, causing the _reject_non_admin_mcp_stdio guard to skip inspection before the type is restored from metadata. The malicious personal action persists and reaches McpPluginFactory.create_connector, so that when the action tool is later invoked, MCPStdioPlugin.connect launches an attacker-chosen operating-system process under the application service identity. No public proof-of-concept was identified, though the fixing commit (73ff7d6) publicly discloses the vulnerable authorization-ordering logic.