CVE-2026-2131

Summary

A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function input_text. The manipulation of the argument text leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Affected Software

Weaknesses

• CWE-78: OS Command Injection
• CWE-77: Command Injection

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://vuldb.com/?id.344766
• https://vuldb.com/?ctiid.344766
• https://vuldb.com/?submit.747209
• https://github.com/scanleale/MCP_sec/blob/main/HarmonyOS-mcp-server%20RCE%20vulnerability.md

• ←Previous
• Next→