PT-2026-36552 · Artmin96 · Yii2-Mcp-Server

Eternity · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-7600

NVD

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii command help/yii execute command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-7600

Affected Products

Yii2-Mcp-Server

References · 7

• 🔥 https://github.com/BruceJqs/public_exp/issues/29 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7600 · Security Note
• https://github.com/ArtMin96/yii2-mcp-server · Note
• https://vuldb.com/vuln/360557/cti · Note
• https://vuldb.com/vuln/360557 · Note
• https://github.com/ArtMin96/yii2-mcp-server/issues/3 · Note
• https://vuldb.com/submit/805613 · Note