CVE-2026-23523: Dive MCP Host RCE Vulnerability

CVE-2026-23523 Overview

CVE-2026-23523 is a code injection vulnerability in Dive, an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to version 0.13.0, a crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user confirmation, leading to arbitrary local command execution on the victim's machine.

Critical Impact

This vulnerability allows remote attackers to achieve arbitrary command execution on victim machines through malicious deeplinks that bypass user confirmation dialogs, potentially leading to complete system compromise.

Affected Products

• Dive MCP Host Desktop Application versions prior to 0.13.0
• Systems running Dive with deeplink handling enabled
• Environments integrating Dive with function-calling LLMs

Discovery Timeline

• January 16, 2026 - CVE-2026-23523 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23523

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The flaw exists in how Dive processes deeplink requests for MCP server configuration installation. The application fails to properly validate and prompt user confirmation when processing deeplinks that contain command execution parameters.

The vulnerability allows an attacker to craft a malicious deeplink that, when clicked by a victim, silently installs an attacker-controlled MCP server configuration. This configuration can then execute arbitrary commands on the local system without adequate user consent or awareness.

Root Cause

The root cause lies in the incomplete validation logic within the application's deeplink handling code. Prior to the fix, the application only triggered a confirmation popup when the transport type was set to stdio. However, configurations containing command or args fields could bypass this check, allowing malicious server configurations to be installed silently.

Attack Vector

The attack leverages the network-accessible deeplink mechanism. An attacker crafts a malicious deeplink URL containing a specially configured MCP server definition with embedded command execution parameters. When a victim clicks this link (typically delivered through phishing, malicious websites, or social engineering), the Dive application processes the deeplink and installs the malicious configuration without proper user confirmation, enabling arbitrary command execution.

         return
       }
 
-      if (_config.transport === "stdio") {
+      if (_config.transport === "stdio" || _config.command || "args" in _config) {
         setInstallToolConfirm(true)
         installToolBuffer.current = { name: data.name, config: _config }
         return

Source: GitHub Commit Update

The patch expands the condition for displaying the installation confirmation popup to include configurations that contain command or args properties, ensuring user confirmation is always required for potentially dangerous server configurations.

Detection Methods for CVE-2026-23523

Indicators of Compromise

• Unexpected MCP server configurations appearing in Dive application settings
• Unusual command execution activity originating from the Dive application process
• Suspicious deeplink activity or URL handler invocations for Dive
• Unauthorized network connections initiated by MCP server configurations

Detection Strategies

• Monitor process creation events from the Dive application for unexpected child processes
• Analyze application logs for deeplink handling events that install new MCP server configurations
• Implement endpoint detection rules to flag command execution through MCP server configurations
• Review installed MCP server configurations for unknown or suspicious entries

Monitoring Recommendations

• Enable verbose logging within Dive application to capture deeplink processing events
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious command execution chains
• Configure network monitoring to detect unusual outbound connections from MCP server processes
• Implement user behavior analytics to identify anomalous Dive application usage patterns

How to Mitigate CVE-2026-23523

Immediate Actions Required

• Upgrade Dive to version 0.13.0 or later immediately
• Audit existing MCP server configurations for unauthorized or suspicious entries
• Educate users about the risks of clicking untrusted deeplinks
• Consider temporarily disabling deeplink handling until the patch is applied

Patch Information

The vulnerability has been fixed in Dive version 0.13.0. The patch ensures that the confirmation popup is displayed whenever an MCP server configuration contains potentially dangerous elements such as command fields or args parameters, regardless of the transport type. Organizations should update to the patched version immediately.

For detailed patch information, refer to the GitHub Commit Update and the GitHub Security Advisory GHSA-pjj5-f3wm-f9m8.

Workarounds

• Disable or restrict deeplink handling for Dive until the patch can be applied
• Implement application whitelisting to control which MCP server configurations can be installed
• Configure network-level controls to block suspicious deeplink traffic
• Use endpoint protection to prevent unauthorized command execution from application contexts

# Configuration example
# Verify Dive version to ensure patched release is installed
# Check installed version in application settings or via package manager
# For npm-based installations:
npm list dive | grep "0.13.0"

# Review MCP server configurations directory for suspicious entries
# Location varies by platform - check Dive documentation for config paths