PT-2026-22811 · Fyodor Vaskovich+1 · Nmap+1

Yinci Chen · Published 2026-03-03 · Updated 2026-03-06 · CVE-2026-3484

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PhialsBasement nmap-mcp-server versions up to bee6d23547d57ae02460022f7c78ac0893092e38

Description A command injection issue exists in the child process.exec function within the Nmap CLI Command Handler component, located in the src/index.ts file. This manipulation can be performed remotely. The product utilizes a rolling release system, and specific version information for affected or updated releases is not disclosed.

Recommendations Apply patch 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488 to resolve this issue.

Exploit

Fix

RCE

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-3484

GHSA-XC68-RRQC-QGQ3

Affected Products

Nmap

Nmap-Mcp-Server

References · 17

• 🔥 https://github.com/PhialsBasement/nmap-mcp-server/issues/7#issuecomment-3814382570 · Exploit
• 🔥 https://github.com/PhialsBasement/nmap-mcp-server/issues/7 · Exploit
• https://github.com/PhialsBasement/nmap-mcp-server/commit/30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488 · Patch
• https://osv.dev/vulnerability/GHSA-xc68-rrqc-qgq3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3484 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3484 · Security Note
• https://github.com/PhialsBasement/nmap-mcp-server · Note
• https://twitter.com/CVEnew/status/2028930725731352982 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028949828965712233 · Twitter Post
• https://twitter.com/Absolcasso/status/2029979109615648837 · Twitter Post
• https://twitter.com/cyberbivash/status/2028930583535964407 · Twitter Post
• https://twitter.com/Absolcasso/status/2029301679687151810 · Twitter Post
• https://vuldb.com/?submit.763773 · Note
• https://vuldb.com/?submit.763777 · Note
• https://vuldb.com/?ctiid.348559 · Note