PT-2026-36030 · Vetcoders · Mcp-Server-Semgrep

Eternity · Published 2026-04-30 · Updated 2026-05-02 · CVE-2026-7446

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VetCoders mcp-server-semgrep version 1.0.0

Description Remote OS command injection is possible within the MCP Interface component in the file src/index.ts. The issue occurs when the ID argument is manipulated, affecting the functions analyze results(), filter results(), export results(), compare results(), scan directory(), and create rule().

Recommendations Upgrade to version 1.0.1.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-7446

GHSA-86HP-QXQP-W9WV

Affected Products

Mcp-Server-Semgrep

References · 14

• 🔥 https://github.com/VetCoders/mcp-server-semgrep/issues/12 · Exploit
• https://github.com/VetCoders/mcp-server-semgrep/commit/141335da044e53c3f5b315e0386e01238405b771 · Patch
• https://github.com/VetCoders/mcp-server-semgrep/releases/tag/v1.0.1 · Patch
• https://github.com/VetCoders/mcp-server-semgrep/pull/15 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7446 · Security Note
• https://osv.dev/vulnerability/GHSA-86hp-qxqp-w9wv · Vendor Advisory
• https://github.com/VetCoders/mcp-server-semgrep · Note
• https://twitter.com/infoflowcloud/status/2049677761460027571 · Twitter Post
• https://vuldb.com/submit/804100 · Note
• https://twitter.com/CVEnew/status/2049677016937517551 · Twitter Post
• https://vuldb.com/vuln/360187 · Note
• https://twitter.com/vitobotta/status/2050684853646229751 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049752041979781578 · Twitter Post
• https://vuldb.com/vuln/360187/cti · Note