CVE-2026-5007: kazuph mcp-docs-rag RCE Vulnerability

CVE-2026-5007 Overview

A command injection vulnerability has been identified in kazuph mcp-docs-rag versions up to 0.5.0. The vulnerability exists in the cloneRepository function within the src/index.ts file, specifically in the add_git_repository and add_text_file components. This flaw allows an attacker with local access to inject arbitrary operating system commands through manipulated input, potentially leading to unauthorized command execution on the underlying system.

Critical Impact

Local attackers can exploit this OS command injection vulnerability to execute arbitrary commands on the system, potentially compromising confidentiality, integrity, and availability of the affected host.

Affected Products

• kazuph mcp-docs-rag versions up to 0.5.0
• Systems running the vulnerable cloneRepository function in src/index.ts
• Deployments utilizing the add_git_repository or add_text_file components

Discovery Timeline

• 2026-03-28 - CVE-2026-5007 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-5007

Vulnerability Analysis

This vulnerability is classified as OS Command Injection (CWE-77), which occurs when an application constructs all or part of an operating system command using externally-influenced input without properly neutralizing special elements that could modify the intended command.

In the case of mcp-docs-rag, the cloneRepository function in src/index.ts fails to properly sanitize user-supplied input before incorporating it into system commands. The add_git_repository and add_text_file components pass user-controlled data that gets processed by this vulnerable function, enabling command injection.

The attack requires local access to the system, meaning the attacker must have some form of authenticated access or physical presence. Once exploited, the vulnerability can lead to limited impact on confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the cloneRepository function. When processing repository URLs or file paths through the add_git_repository and add_text_file components, the application fails to escape or validate special shell characters and command separators. This allows attackers to break out of the intended command context and inject additional malicious commands.

The vulnerability stems from directly concatenating or interpolating user input into shell commands without using proper parameterization or input sanitization techniques that would prevent command injection attacks.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access to the system where mcp-docs-rag is running. An attacker can exploit this vulnerability by providing specially crafted input containing shell metacharacters (such as ;, |, &&, ||, or backticks) to the vulnerable components.

For example, when a user provides a malicious repository URL or file path to the add_git_repository or add_text_file functions, the crafted input could include command separators followed by arbitrary commands. These injected commands would then be executed with the privileges of the application process.

The vulnerability has been publicly disclosed through a GitHub Issue Discussion, and detailed technical information is available in the Bug Report PDF. The project maintainers were notified through an issue report but have not responded yet.

Detection Methods for CVE-2026-5007

Indicators of Compromise

• Unusual process spawning from the mcp-docs-rag application or its Node.js parent process
• Unexpected shell command execution patterns in system logs containing special characters like ;, |, &&, or backticks
• Anomalous network connections or file system modifications originating from the application context
• Log entries showing malformed or suspicious repository URLs or file paths being processed

Detection Strategies

• Monitor system call activity from the mcp-docs-rag process for unexpected command execution using tools like auditd or EDR solutions
• Implement application-level logging to capture all input to the add_git_repository and add_text_file functions
• Deploy behavioral detection rules that alert on child process creation from Node.js applications executing shell commands
• Review application logs for input containing shell metacharacters or command injection patterns

Monitoring Recommendations

• Enable comprehensive audit logging for the system running mcp-docs-rag to capture command execution events
• Configure SentinelOne to monitor for suspicious process trees where Node.js spawns unexpected child processes
• Set up alerts for any attempts to access sensitive system resources from the application context
• Regularly review the GitHub repository for security updates and patches

How to Mitigate CVE-2026-5007

Immediate Actions Required

• Restrict local access to systems running mcp-docs-rag to only trusted users until a patch is available
• Implement input validation at the application or network perimeter to filter malicious input patterns
• Consider temporarily disabling the add_git_repository and add_text_file functionality if not critical to operations
• Monitor the GitHub Issue Discussion for vendor response and patches

Patch Information

As of the last update on 2026-03-30, no official patch has been released by the project maintainers. The project was informed of the vulnerability through a GitHub issue report but has not yet responded. Users should monitor the official repository for security updates and upgrade to patched versions when available. Additional vulnerability details can be found at VulDB.

Workarounds

• Implement strict input validation to reject any input containing shell metacharacters before it reaches the vulnerable functions
• Run the mcp-docs-rag application in a sandboxed environment or container with minimal privileges
• Use application-level firewalls or web application firewalls (if applicable) to filter malicious input patterns
• Consider forking the repository and implementing proper input sanitization using safe command execution methods

# Example: Run mcp-docs-rag with restricted permissions using a dedicated user
# Create a restricted user for the application
sudo useradd -r -s /bin/false mcp-docs-user

# Run the application with limited privileges
sudo -u mcp-docs-user node /path/to/mcp-docs-rag/src/index.ts

# Alternatively, use a container with restricted capabilities
docker run --cap-drop=ALL --security-opt=no-new-privileges mcp-docs-rag:latest