PT-2026-27217 · Blinko · Blinko

Tx1Ee · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-23882

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.4

Description Blinko is an AI-powered card note-taking project. The server creation function for the Model Context Protocol (MCP) allows specification of arbitrary commands and arguments. These commands are executed during connection testing. This allows for potential remote code execution.

Recommendations Update to version 1.8.4 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-23882

GHSA-59R2-82P8-C56V

Affected Products

Blinko

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23882.json · Exploit
• https://github.com/blinkospace/blinko/commit/bef6b770743e87c630db2d00d7049dabd96bfe85 · Patch
• https://github.com/blinkospace/blinko/security/advisories/GHSA-59r2-82p8-c56v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23882 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23882 · Vendor Advisory
• https://github.com/blinkospace/blinko/releases/tag/1.8.4 · Note
• https://twitter.com/CveFindCom/status/2036189286886694975 · Twitter Post
• https://twitter.com/cyberbivash/status/2036206819803119674 · Twitter Post