PT-2026-7010 · Lldb+1 · Lldb+1

Lexpl0It · Publicado 2026-02-08 · Atualizado 2026-03-05 · CVE-2026-2178

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions r-huijts xcode-mcp-server versions up to f3419f00117aa9949e326f78cc940166c88f18cb

Description A command injection issue exists in the registerXcodeTools function within the src/tools/xcode/index.ts file of the run lldb component. Manipulation of the args argument can lead to remote command execution. The exploit has been publicly released.

Recommendations Apply the patch identified as 11f8d6bacadd153beee649f92a78a9dad761f56f to resolve this issue.

Exploit

Correção

Special Elements Injection

Command Injection

Enumeração de Fraquezas

CWE-74

CWE-77

Identificadores relacionados

CVE-2026-2178

GHSA-84FX-PWF3-7777

Produtos afetados

Lldb

Xcode-Mcp-Server

Referências · 13

• 🔥 https://github.com/r-huijts/xcode-mcp-server/issues/13#issue-3878065790 · Exploit
• 🔥 https://github.com/r-huijts/xcode-mcp-server/issues/13 · Exploit
• https://github.com/r-huijts/xcode-mcp-server/commit/11f8d6bacadd153beee649f92a78a9dad761f56f · Correção
• https://github.com/r-huijts/xcode-mcp-server · Nota
• https://osv.dev/vulnerability/GHSA-84fx-pwf3-7777 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-2178 · Aviso do Fabricante
• https://vuldb.com/?ctiid.344881 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2178 · Nota de Segurança
• https://vuldb.com/?id.344881 · Nota
• https://t.me/CVEtracker/44126 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2020582969216315903 · Publicação no Twitter
• https://t.me/cveNotify/154413 · Publicação no Telegram
• https://vuldb.com/?submit.749569 · Nota