PT-2026-36552 · Artmin96 · Yii2-Mcp-Server

Eternity · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-7600

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ArtMin96 yii2-mcp-server version 1.0.2

Description A flaw in the MCP Interface component, specifically within the yii command help/yii execute command() function of the src/index.ts file, allows for remote OS command injection. This occurs when a manipulation is executed, potentially leading to complete server compromise.

Recommendations Remove version 1.0.2. As a temporary workaround, restrict access to the yii command help/yii execute command() function to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-7600

GHSA-GC8W-X73W-P4RH

Affected Products

Yii2-Mcp-Server

References · 14

• 🔥 https://github.com/BruceJqs/public_exp/issues/29 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7600 · Security Note
• https://osv.dev/vulnerability/GHSA-gc8w-x73w-p4rh · Vendor Advisory
• https://github.com/ArtMin96/yii2-mcp-server · Note
• https://github.com/ArtMin96/yii2-mcp-server/issues/3 · Note
• https://vuldb.com/vuln/360557 · Note
• https://twitter.com/infoflowcloud/status/2050436600622883235 · Twitter Post
• https://twitter.com/CVEarity/status/2050462084048310329 · Twitter Post
• https://t.me/CVEtracker/52474 · Telegram Post
• https://vuldb.com/submit/805613 · Note
• https://twitter.com/NewsNerdie/status/2050486025743429787 · Twitter Post
• https://twitter.com/CVEnew/status/2050434979050525060 · Twitter Post
• https://t.me/cveNotify/161827 · Telegram Post
• https://vuldb.com/vuln/360557/cti · Note