PT-2026-32188 · Chatboxai+1 · Chatboxai+1

Yu_Bao · Published 2026-04-12 · Updated 2026-04-13 · CVE-2026-6130

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions chatboxai chatbox versions up to 1.20.0

Description A flaw exists in the StdioClientTransport function within the src/main/mcp/ipc-stdio-transport.ts file of the Model Context Protocol Server Management System component. Manipulation of the args/env argument can lead to os command injection. The attack can be launched remotely. The exploit has been published.

Recommendations Update to a version beyond 1.20.0.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-6130

Affected Products

Model Context Protocol Server Management System

Chatboxai

References · 9

• 🔥 https://github.com/chatboxai/chatbox/issues/3627#issue-4193060116 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6130 · Security Note
• https://github.com/chatboxai/chatbox/issues/3627 · Note
• https://twitter.com/VulmonFeeds/status/2043468500484653533 · Twitter Post
• https://vuldb.com/vuln/356993 · Note
• https://twitter.com/CVEnew/status/2043561038583390493 · Twitter Post
• https://github.com/chatboxai/chatbox · Note
• https://vuldb.com/submit/795355 · Note
• https://vuldb.com/vuln/356993/cti · Note