Mcp Dnstwist
Monthly
OS command injection in BurtTheCoder mcp-dnstwist through version 1.0.4 allows remote attackers to execute arbitrary operating system commands by manipulating the domain argument passed to the fuzz_domain function in the MCP Interface. Publicly available exploit code exists (hosted on GitHub), and SSVC classifies this as automatable with a poc-level exploitation status. No vendor patch has been released, as the project maintainer has not responded to the coordinated disclosure filed via GitHub issue.
OS command injection in BurtTheCoder mcp-dnstwist through version 1.0.4 allows remote attackers to execute arbitrary operating system commands by manipulating the domain argument passed to the fuzz_domain function in the MCP Interface. Publicly available exploit code exists (hosted on GitHub), and SSVC classifies this as automatable with a poc-level exploitation status. No vendor patch has been released, as the project maintainer has not responded to the coordinated disclosure filed via GitHub issue.