CVE-2026-19279: MIMICLab mcp-pdf-vision RCE Vulnerability

CVE-2026-19279 Overview

CVE-2026-19279 is a command injection vulnerability in MIMICLab mcp-pdf-vision version 1.1.0. The flaw resides in the load_pdf function within src/index.ts. Attackers manipulate the pdfPath or sessionId argument to inject operating system commands. Exploitation requires local access with low privileges, limiting the blast radius. The maintainers received an issue report but have not yet responded with a fix. The weakness is categorized under CWE-74 for improper neutralization of special elements in output used by a downstream component.

Critical Impact
A local, authenticated attacker can execute arbitrary operating system commands through the load_pdf function by supplying crafted pdfPath or sessionId values.

Affected Products

MIMICLab mcp-pdf-vision version 1.1.0
The load_pdf function in src/index.ts
Deployments exposing the Model Context Protocol (MCP) PDF vision server locally

Discovery Timeline

2026-08-08 - CVE-2026-19279 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19279

Vulnerability Analysis

The vulnerability affects the load_pdf function in src/index.ts of the mcp-pdf-vision project. The function accepts caller-supplied values through the pdfPath and sessionId parameters. These values are passed into a downstream command context without adequate neutralization of shell metacharacters. An attacker with local access supplies input containing shell separators or substitution characters. The underlying command interpreter then executes attacker-controlled operating system commands in the process context of the MCP server.

The attack requires local access and low-level privileges to invoke the affected function. The Exploit Prediction Scoring System (EPSS) probability is 0.731%, reflecting a low but non-negligible likelihood of exploit activity in the near term. No public proof-of-concept exploit has been published beyond the referenced issue tracker.

Root Cause

The root cause is missing input sanitization on the pdfPath and sessionId arguments before they reach a shell or child-process invocation. The load_pdf implementation does not validate that pdfPath refers to a well-formed filesystem path or that sessionId conforms to an expected identifier format. This maps to CWE-74, improper neutralization of special elements in output used by a downstream component.

Attack Vector

Exploitation is local. An attacker on the same host as the MCP server invokes the load_pdf tool through the MCP interface. The attacker embeds shell metacharacters, such as command separators or command substitution syntax, in the pdfPath or sessionId argument. When the server constructs the downstream command, the injected characters break out of the intended argument context. The injected payload executes with the privileges of the MCP process.

For technical details on the flaw and reproduction steps, see the GitHub issue tracker and the VulDB advisory.

Detection Methods for CVE-2026-19279

Indicators of Compromise

Child processes spawned by the mcp-pdf-vision server that are not standard PDF rendering utilities, such as sh, bash, cmd.exe, or powershell.exe.
MCP request logs containing shell metacharacters (;, |, &, `, $() inside the pdfPath or sessionId fields.
Unexpected outbound network connections initiated by the Node.js process hosting mcp-pdf-vision.

Detection Strategies

Enable process-lineage telemetry on hosts running the MCP server and alert when the node process executing mcp-pdf-vision spawns a shell interpreter.
Inspect MCP tool-call payloads for characters that are not valid in filesystem paths or session identifiers.
Correlate load_pdf invocations with subsequent filesystem writes or network activity that would not be expected from a PDF rendering workflow.

Monitoring Recommendations

Log every invocation of the load_pdf tool with the full argument list for post-hoc review.
Baseline the expected child-process tree for the MCP server and alert on deviations.
Monitor for outbound egress from developer workstations running local MCP servers, since exploitation runs in the user's context.

How to Mitigate CVE-2026-19279

Immediate Actions Required

Restrict access to the mcp-pdf-vision server so that only trusted local clients can reach the MCP endpoint.
Avoid passing untrusted or attacker-influenced values into the pdfPath or sessionId parameters of load_pdf.
Run the MCP server under a dedicated low-privilege user account to limit the impact of successful injection.

Patch Information

No vendor patch is available at the time of publication. The upstream project was notified through the GitHub issue tracker but has not responded. Track the MIMICLab mcp-pdf-vision repository for a fixed release.

Workarounds

Wrap load_pdf calls with an allowlist that validates pdfPath against a known directory and rejects any path containing shell metacharacters.
Constrain sessionId to a fixed character set, such as hexadecimal or UUID format, before it reaches the server.
Disable or remove the mcp-pdf-vision integration in environments where PDF ingestion is not required until a patched version is released.

bash

# Configuration example: run the MCP server under a restricted account
# and validate arguments at the wrapper layer before invoking load_pdf.
useradd -r -s /usr/sbin/nologin mcp-pdf
chown -R mcp-pdf:mcp-pdf /opt/mcp-pdf-vision
sudo -u mcp-pdf node /opt/mcp-pdf-vision/dist/index.js \
  --allowed-pdf-dir /var/lib/mcp-pdf/inbox \
  --session-id-regex '^[a-f0-9]{32}$'