Mcp4Eda
Monthly
Command injection in NellyW8 MCP4EDA 1.0.0 allows a local low-privileged attacker to execute arbitrary OS commands by manipulating the design_name or vcd_file arguments passed to the run_openlane or view_waveform components. The vulnerability arises from unsanitized argument handling and was reported to the maintainer via GitHub issue #3, but has received no vendor response to date. A proof-of-concept exploit exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been identified.
Command injection in NellyW8 MCP4EDA 1.0.0 allows a local low-privileged attacker to execute arbitrary OS commands by manipulating the design_name or vcd_file arguments passed to the run_openlane or view_waveform components. The vulnerability arises from unsanitized argument handling and was reported to the maintainer via GitHub issue #3, but has received no vendor response to date. A proof-of-concept exploit exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been identified.