s1ko/cve-2026-52616Advisory and benign PoC for OS command injection in an nmap MCP server, with duplicate CVE tracking, detection guidance, and mitigation.
run_nmap_scanThe run_nmap_scan MCP tool builds its command by string interpolation of the
target and additionalFlags parameters and runs it through
child_process.exec, i.e. /bin/sh -c.
⚠ Read this first — duplicate identifier
This vulnerability was already public before this CVE ID existed. It is covered by , assigned by VulDB and published 2026-03-03 against — same package, same CWE-78 sink.
mcp-nmap-server <= 1.0.1child_process.execCVE-2026-52616 was assigned to s1ko by MITRE CNA-LR on 2026-07-13 in response to an independent report. That assignment appears to be a duplicate, and it has been flagged as such. The pre-existing identifier CVE-2026-3484 is the one that should be cited.
This repository is published for completeness and to document the duplicate, not as a claim of novel discovery. The credit for the original public disclosure is not s1ko's.
| CVE | CVE-2026-52616 — duplicate of CVE-2026-3484 |
| CWE | CWE-78 (Improper Neutralization of Special Elements used in an OS Command) |
| Package | mcp-nmap-server (npm) |
| Affected | 1.0.1 and earlier — all published versions |
| Fixed in | none — repository archived |
| CVSS v3.1 | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.4 High (stdio transport). AV:N → 9.8 Critical if the server is wrapped in a network transport. |
| Independently reported by | s1ko (github.com/s1ko, [email protected]) |
| CVE assigned | 2026-07-13, MITRE CNA-LR |
A naming trap worth noting for anyone deduplicating this: the npm package is
mcp-nmap-server and the repository is nmap-mcp-server. The two orderings
refer to the same project.
MCP tool arguments are attacker-influenced. They are produced by an LLM from
the content the agent processes — documents, web pages, tool output — so
indirect prompt injection puts an attacker in control of the values a tool
handler receives. A handler that feeds any of those values into a shell turns
that influence into code execution on the host running the MCP server. This is
the same model as the precedent case aws-mcp-server / CVE-2026-5058.
dist/index.js — the target is appended to a command string which is then
handed to exec:
command += ` ${target}`;
…
const { stdout, stderr } = await promisify(exec)(command);
child_process.exec runs its argument in /bin/sh -c, so everything the
caller contributed is shell syntax. The Zod input schema declares z.string(),
which validates type and says nothing about content, so metacharacters pass
through. additionalFlags reaches the same string by the same route.
A run_nmap_scan call with target set to
127.0.0.1; touch /tmp/marker; echo INJECTED produces:
/bin/sh -c "nmap … 127.0.0.1; touch /tmp/marker; echo INJECTED"
poc/driver.mjs speaks MCP over stdio: it initializes the
server, issues one tools/call for run_nmap_scan with an injected target,
and checks for a marker file. The payload is a benign touch.
npm pack [email protected]
tar xf mcp-nmap-server-1.0.1.tgz && cd package && npm install
node ../poc/driver.mjs
Expected on an affected version:
==== POC RESULT (mcp-nmap-server) ====
marker /tmp/PWNED_nmap created: true
verdict: CONFIRMED — command injection executed
nmap does not need to be installed — the injected command runs in the same
/bin/sh -c string regardless of whether the leading binary resolves.
Validated 2026-06-01 in an isolated container and re-validated 2026-06-13.
Run it only against infrastructure you are authorized to test.
nmap command line containing ;, &&, ||, |, a backtick or $(.sh -c process whose command line starts with nmap and contains a second
command after a separator — a process-tree signal (auditd, eBPF, Falco, EDR)
that does not depend on application logging.nmap is expected; a shell,
an interpreter or a network client is not.target or additionalFlags contain shell
metacharacters. A target should match an IP, CIDR or hostname and nothing
else.MITRE ATT&CK T1059.004 Command and Scripting Interpreter: Unix Shell.
The repository is archived and read-only, npm latest is the affected 1.0.1, and no patched release will be published. Removal is the mitigation:
target against an IP/CIDR/hostname
pattern and to allowlist additionalFlags before either reaches the command
string.The fix, for anyone forking it, is to call
execFile("nmap", [...args]) with an argument vector instead of building a
string for exec. Content validation, not just Zod type validation, is the
underlying requirement.
NIST SP 800-53r5 SI-10; OWASP ASVS v4 §5.3.8; CWE-78 mitigations M1 and M2.
| Date | Event |
|---|---|
| 2026-03-03 | CVE-2026-3484 / GHSA-xc68-rrqc-qgq3 published by VulDB — the original public disclosure, by another reporter |
| 2026-05-29 | Independently identified by source review of the published tarball, unaware of the March advisory |
| 2026-06-01 | Dynamically validated over MCP stdio in an isolated container |
| 2026-06-13 | Duplicate identified during pre-submission deduplication; repository confirmed archived with Private Vulnerability Reporting unavailable. Internal verdict: do not file |
| 2026-07-13 | MITRE CNA-LR assigns CVE-2026-52616 regardless, crediting s1ko as discoverer |
| 2026-08-22 | This write-up published, documenting the duplicate |
aws-mcp-server)Companion advisories from the same research pass: CVE-2026-52617, CVE-2026-52618.
MIT — see LICENSE.