CVE-2026-2178: xcode-mcp-server RCE Vulnerability

CVE-2026-2178 Overview

A command injection vulnerability was discovered in r-huijts xcode-mcp-server up to commit f3419f00117aa9949e326f78cc940166c88f18cb. This vulnerability affects the registerXcodeTools function in the file src/tools/xcode/index.ts within the run_lldb component. The flaw allows remote attackers to execute arbitrary commands through manipulation of the args argument, resulting in command injection (CWE-74).

Critical Impact

Remote attackers can exploit this command injection vulnerability to execute arbitrary system commands on the affected server, potentially leading to full system compromise, data exfiltration, or lateral movement within the network.

Affected Products

• r-huijts xcode-mcp-server (commits up to f3419f00117aa9949e326f78cc940166c88f18cb)
• xcode-mcp-server rolling release versions prior to patch 11f8d6bacadd153beee649f92a78a9dad761f56f

Discovery Timeline

• 2026-02-08 - CVE-2026-2178 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-2178

Vulnerability Analysis

The command injection vulnerability exists in the xcode-mcp-server's run_lldb component. The application uses the Node.js exec() function from the child_process module to execute system commands. When user-controlled input is passed to the args parameter without proper sanitization, an attacker can inject arbitrary shell commands that will be executed with the privileges of the server process.

The vulnerable code path involves the registerXcodeTools function in src/tools/xcode/index.ts, where arguments are concatenated into a command string and passed to a shell for execution. Since exec() spawns a shell to interpret the command, special characters like ;, |, &&, or backticks can be used to break out of the intended command context and execute additional commands.

This product uses a rolling release model, meaning traditional version-based tracking is not available. Users must verify their installation against the specific commit hash to determine vulnerability status.

Root Cause

The root cause is the use of exec() for subprocess invocation, which spawns a shell and interprets the command string. When user-controlled data is incorporated into this command string without proper sanitization or escaping, shell metacharacters can be used to inject additional commands. This is a classic CWE-78 (OS Command Injection) pattern that falls under the broader CWE-74 (Improper Neutralization of Special Elements) category.

Attack Vector

The attack can be initiated remotely over the network. An attacker who can send requests to the xcode-mcp-server can craft malicious input containing shell metacharacters. When this input reaches the registerXcodeTools function's args parameter, the injected commands are executed by the underlying shell.

The security patch addresses this by replacing exec() with execFile(), which directly invokes the target binary without spawning an intermediate shell:

import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { exec } from "child_process";
-import { promisify } from "util";
import * as fs from "fs/promises";
+import { runExecFile } from "./utils/execFile.js";
import * as fsSync from "fs";
import * as path from "path";
import * as os from "os";

Source: GitHub Commit Details

The new runExecFile utility function implements the secure pattern:

+import { execFile } from "child_process";
+import { promisify } from "util";
+import { CommandExecutionError } from "./errors.js";
+
+const execFileAsync = promisify(execFile);
+
+export interface RunExecFileOptions {
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+  timeout?: number;
+  maxBuffer?: number;
+}
+
+/**
+ * Run a binary with argument array. No shell is invoked; arguments are passed
+ * literally to the process. Use this instead of exec() to prevent CWE-78
+ * command injection when any argument is or could be user-controlled.
+ */
+export async function runExecFile(
+  file: string,
+  args: string[],
+  options?: RunExecFileOptions
+): Promise<{ stdout: string; stderr: string }> {
+  try {
+    const result = await execFileAsync(file, args, {
+      encoding: "utf8",
+      ...options,
+    });
+    return {
+      stdout: result.stdout ?? "",

Source: GitHub Commit Details

Detection Methods for CVE-2026-2178

Indicators of Compromise

• Unexpected process spawns originating from the xcode-mcp-server process
• Command-line arguments containing shell metacharacters (;, |, &&, $(), backticks) in server logs
• Unusual network connections or file system modifications initiated by the server process
• Evidence of reconnaissance commands (whoami, id, uname) in process audit logs

Detection Strategies

• Implement process monitoring to detect child processes spawned by the xcode-mcp-server with unexpected command patterns
• Deploy application-level logging to capture all arguments passed to the run_lldb component
• Utilize endpoint detection and response (EDR) solutions to identify command injection attack patterns
• Monitor for shell metacharacter sequences in incoming requests to the MCP server

Monitoring Recommendations

• Enable audit logging for all subprocess invocations on systems running xcode-mcp-server
• Configure alerts for process trees showing suspicious command chains originating from Node.js processes
• Implement network traffic analysis to detect potential exploitation attempts targeting the MCP protocol
• Review server access logs for requests containing encoded shell metacharacters

How to Mitigate CVE-2026-2178

Immediate Actions Required

• Update xcode-mcp-server to a version containing patch commit 11f8d6bacadd153beee649f92a78a9dad761f56f or later
• Review server logs for evidence of past exploitation attempts
• Implement network-level restrictions to limit access to the xcode-mcp-server to trusted clients only
• Consider temporarily disabling the run_lldb functionality until patched

Patch Information

The vulnerability has been addressed in commit 11f8d6bacadd153beee649f92a78a9dad761f56f. The fix refactors all subprocess invocations to use execFile() instead of exec(), preventing shell interpretation of user-controlled arguments. Since xcode-mcp-server uses a rolling release model, users should pull the latest version from the GitHub repository to obtain the fix. Additional details are available in the GitHub Issue Discussion.

Workarounds

• Restrict network access to the xcode-mcp-server using firewall rules to allow only trusted IP addresses
• Implement an application-layer proxy that validates and sanitizes input before forwarding to the server
• Run the xcode-mcp-server in a sandboxed environment with minimal system privileges
• Deploy web application firewall (WAF) rules to block requests containing common command injection patterns

# Example: Restrict access to xcode-mcp-server using iptables
# Allow only localhost and trusted network
iptables -A INPUT -p tcp --dport 3000 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP