PT-2026-34753 · Unknown · Radare2-Mcp

Manthan Ghasadiya · Published 2026-03-24 · Updated 2026-04-26 · CVE-2026-6942

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions radare2-mcp versions 1.6.0 and earlier

Description An OS command injection flaw allows remote, unauthenticated attackers to execute arbitrary commands on the host system. This is achieved by bypassing the command filter using shell metacharacters in user-controlled input passed to the r2 cmd str() function via parameters in the jsonrpc interface.

Recommendations Update to a version later than 1.6.0.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-07861

CVE-2026-6942

Affected Products

Radare2-Mcp

References · 7

• 🔥 https://github.com/radareorg/radare2-mcp/issues/45 · Exploit
• https://github.com/radareorg/radare2-mcp/commit/482cde6500009112a8bc0b3fa8d2ef6180581ec0 · Patch
• https://bdu.fstec.ru/vul/2026-07861 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-6942 · Security Note
• https://vulncheck.com/advisories/radare2-mcp-os-command-injection-via-shell-metacharacter-bypass · Note
• https://twitter.com/OrizonCyber/status/2047435384603222387 · Twitter Post
• https://twitter.com/g_m_j_2703/status/2048233883934642505 · Twitter Post