PT-2026-30512 · Nor2 Io · Heim-Mcp

Yinci Chen · Published 2026-04-05 · Updated 2026-04-06 · CVE-2026-5602

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nor2-io heim-mcp versions up to 0.1.3

Description A flaw exists in the registerTools function within the src/tools.ts file of the new heim application/deploy heim application/deploy heim application to cloud component. This can lead to operating system command injection, requiring local access for exploitation. The issue has been publicly disclosed.

Recommendations Install patch c321d8af25f77668781e6ccb43a1336f9185df37 to address this issue.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-5602

GHSA-WX4P-JR66-JFP9

Affected Products

Heim-Mcp

References · 14

• 🔥❌ https://github.com/user-attachments/files/25889482/heim-mcp_bug.pdf · Exploit, Deleted
• https://github.com/Nor2-io/heim-mcp/commit/c321d8af25f77668781e6ccb43a1336f9185df37 · Patch
• https://github.com/Nor2-io/heim-mcp/pull/2 · Patch
• https://osv.dev/vulnerability/GHSA-wx4p-jr66-jfp9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5602 · Security Note
• https://github.com/Nor2-io/heim-mcp/issues/1 · Note
• https://github.com/Nor2-io/heim-mcp · Note
• https://vuldb.com/vuln/355394 · Note
• https://twitter.com/cyberbivash/status/2040964646157365289 · Twitter Post
• https://twitter.com/cyberbivash/status/2041032465788092769 · Twitter Post
• https://vuldb.com/submit/784862 · Note
• https://vuldb.com/vuln/355394/cti · Note
• https://twitter.com/CVEnew/status/2040927622624895293 · Twitter Post
• https://twitter.com/infoflowcloud/status/2040928797222994126 · Twitter Post