CVE-2026-52616 — mcp-nmap-server: OS command injection via run_nmap_scan

The run_nmap_scan MCP tool builds its command by string interpolation of the target and additionalFlags parameters and runs it through child_process.exec, i.e. /bin/sh -c.

⚠ Read this first — duplicate identifier

This vulnerability was already public before this CVE ID existed. It is covered by CVE-2026-3484 / GHSA-xc68-rrqc-qgq3, assigned by VulDB and published 2026-03-03 against mcp-nmap-server <= 1.0.1 — same package, same CWE-78 child_process.exec sink.

CVE-2026-52616 was assigned to s1ko by MITRE CNA-LR on 2026-07-13 in response to an independent report. That assignment appears to be a duplicate, and it has been flagged as such. The pre-existing identifier CVE-2026-3484 is the one that should be cited.

This repository is published for completeness and to document the duplicate, not as a claim of novel discovery. The credit for the original public disclosure is not s1ko's.

A naming trap worth noting for anyone deduplicating this: the npm package is mcp-nmap-server and the repository is nmap-mcp-server. The two orderings refer to the same project.

Threat model

MCP tool arguments are attacker-influenced. They are produced by an LLM from the content the agent processes — documents, web pages, tool output — so indirect prompt injection puts an attacker in control of the values a tool handler receives. A handler that feeds any of those values into a shell turns that influence into code execution on the host running the MCP server. This is the same model as the precedent case aws-mcp-server / CVE-2026-5058.

Execution

dist/index.js — the target is appended to a command string which is then handed to exec:

command += ` ${target}`;
…
const { stdout, stderr } = await promisify(exec)(command);

child_process.exec runs its argument in /bin/sh -c, so everything the caller contributed is shell syntax. The Zod input schema declares z.string(), which validates type and says nothing about content, so metacharacters pass through. additionalFlags reaches the same string by the same route.

A run_nmap_scan call with target set to 127.0.0.1; touch /tmp/marker; echo INJECTED produces:

/bin/sh -c "nmap … 127.0.0.1; touch /tmp/marker; echo INJECTED"

Reproduction

poc/driver.mjs speaks MCP over stdio: it initializes the server, issues one tools/call for run_nmap_scan with an injected target, and checks for a marker file. The payload is a benign touch.

npm pack [email protected]
tar xf mcp-nmap-server-1.0.1.tgz && cd package && npm install
node ../poc/driver.mjs

Expected on an affected version:

==== POC RESULT (mcp-nmap-server) ====
marker /tmp/PWNED_nmap created: true
verdict: CONFIRMED — command injection executed

nmap does not need to be installed — the injected command runs in the same /bin/sh -c string regardless of whether the leading binary resolves. Validated 2026-06-01 in an isolated container and re-validated 2026-06-13. Run it only against infrastructure you are authorized to test.

Detection

• An nmap command line containing ;, &&, ||, |, a backtick or $(.
• A sh -c process whose command line starts with nmap and contains a second command after a separator — a process-tree signal (auditd, eBPF, Falco, EDR) that does not depend on application logging.
• Unexpected children of the MCP server process. nmap is expected; a shell, an interpreter or a network client is not.
• MCP tool-call logs where target or additionalFlags contain shell metacharacters. A target should match an IP, CIDR or hostname and nothing else.

MITRE ATT&CK T1059.004 Command and Scripting Interpreter: Unix Shell.

Mitigation

The repository is archived and read-only, npm latest is the affected 1.0.1, and no patched release will be published. Removal is the mitigation:

• Stop using the package. It is unmaintained, publicly vulnerable since March 2026, and will not be fixed.
• If it must stay, run it in a container or VM as an unprivileged user, with no credentials in its environment and no network egress beyond the scan range, and do not expose it over a network transport.
• Wrap or fork the server to validate target against an IP/CIDR/hostname pattern and to allowlist additionalFlags before either reaches the command string.

The fix, for anyone forking it, is to call execFile("nmap", [...args]) with an argument vector instead of building a string for exec. Content validation, not just Zod type validation, is the underlying requirement.

NIST SP 800-53r5 SI-10; OWASP ASVS v4 §5.3.8; CWE-78 mitigations M1 and M2.

Timeline

References

• Original advisory — https://github.com/advisories/GHSA-xc68-rrqc-qgq3
• Original CVE — https://nvd.nist.gov/vuln/detail/CVE-2026-3484
• npm package — https://www.npmjs.com/package/mcp-nmap-server
• Repository (archived) — https://github.com/PhialsBasement/nmap-mcp-server
• Precedent for the MCP threat model — CVE-2026-5058 (aws-mcp-server)

Companion advisories from the same research pass: CVE-2026-52617, CVE-2026-52618.

License

MIT — see LICENSE.