PT-2026-7010 · Lldb+1 · Lldb+1

Lexpl0It · Published 2026-02-08 · Updated 2026-03-05 · CVE-2026-2178

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions r-huijts xcode-mcp-server versions up to f3419f00117aa9949e326f78cc940166c88f18cb

Description A command injection issue exists in the registerXcodeTools function within the src/tools/xcode/index.ts file of the run lldb component. Manipulation of the args argument can lead to remote command execution. The exploit has been publicly released.

Recommendations Apply the patch identified as 11f8d6bacadd153beee649f92a78a9dad761f56f to resolve this issue.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-2178

GHSA-84FX-PWF3-7777

Affected Products

Lldb

Xcode-Mcp-Server

References · 13

• 🔥 https://github.com/r-huijts/xcode-mcp-server/issues/13#issue-3878065790 · Exploit
• 🔥 https://github.com/r-huijts/xcode-mcp-server/issues/13 · Exploit
• https://github.com/r-huijts/xcode-mcp-server/commit/11f8d6bacadd153beee649f92a78a9dad761f56f · Patch
• https://osv.dev/vulnerability/GHSA-84fx-pwf3-7777 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2178 · Security Note
• https://github.com/r-huijts/xcode-mcp-server · Note
• https://vuldb.com/?ctiid.344881 · Note
• https://vuldb.com/?id.344881 · Note
• https://t.me/CVEtracker/44126 · Telegram Post
• https://twitter.com/CVEnew/status/2020582969216315903 · Twitter Post
• https://t.me/cveNotify/154413 · Telegram Post
• https://vuldb.com/?submit.749569 · Note