PT-2026-30564 · Chrischinchilla · Vale-Mcp

Brucejin · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5621

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ChrisChinchilla Vale-MCP versions up to 0.1.0

Description A vulnerability exists in ChrisChinchilla Vale-MCP up to version 0.1.0, specifically within the file src/index.ts of the HTTP Interface component. The manipulation of the config path argument results in OS command injection. Local access is required for exploitation. The exploit has been publicly disclosed.

Recommendations Update ChrisChinchilla Vale-MCP to a version beyond 0.1.0.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-5621

Affected Products

Vale-Mcp

References · 7

• 🔥 https://github.com/wing3e/public_exp/issues/27 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5621 · Security Note
• https://twitter.com/infoflowcloud/status/2041032195658138017 · Twitter Post
• https://vuldb.com/vuln/355411/cti · Note
• https://vuldb.com/vuln/355411 · Note
• https://twitter.com/CVEnew/status/2041031317643809123 · Twitter Post
• https://vuldb.com/submit/785591 · Note