CVE-2026-5023: codebase-mcp OS Command Injection RCE Flaw

CVE-2026-5023 Overview

A command injection vulnerability has been identified in DeDeveloper23 codebase-mcp, affecting the RepoMix Command Handler component. The vulnerability exists in the getCodebase, getRemoteCodebase, and saveCodebase functions within the src/tools/codebase.ts file. Successful exploitation allows an attacker with local access to inject and execute arbitrary operating system commands on the affected system.

Critical Impact

Local attackers can execute arbitrary OS commands through the vulnerable RepoMix Command Handler, potentially leading to system compromise, data theft, or further lateral movement within the environment.

Affected Products

• DeDeveloper23 codebase-mcp up to commit 3ec749d237dd8eabbeef48657cf917275792fde6
• All versions prior to the vulnerable commit (rolling release model)

Discovery Timeline

• 2026-03-29 - CVE-2026-5023 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-5023

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). The vulnerable functions in src/tools/codebase.ts fail to properly sanitize user-controllable input before passing it to system command execution routines. This allows attackers with local access to craft malicious input that breaks out of the intended command context and executes arbitrary OS commands.

The codebase-mcp project implements a Model Context Protocol (MCP) server for codebase analysis, and the RepoMix Command Handler processes repository-related operations. The affected functions—getCodebase, getRemoteCodebase, and saveCodebase—appear to construct and execute shell commands without adequate input validation, creating the command injection vector.

Root Cause

The root cause is improper input validation and sanitization in the command construction logic within the RepoMix Command Handler. User-supplied parameters are concatenated directly into command strings without escaping shell metacharacters or using parameterized command execution methods, allowing command separators and injection payloads to be interpreted by the underlying shell.

Attack Vector

The attack requires local access to the system running codebase-mcp. An attacker must be able to invoke the vulnerable functions with crafted input containing shell metacharacters (such as ;, |, &&, ||, or backticks). When the application executes the constructed command, the injected payload is executed with the privileges of the codebase-mcp process.

The vulnerability has been publicly disclosed through a GitHub Issue, and details have been submitted to VulDB. The project maintainers were notified but have not yet responded.

Detection Methods for CVE-2026-5023

Indicators of Compromise

• Unusual command execution patterns originating from Node.js or codebase-mcp processes
• Presence of shell metacharacters (;, |, &&, $(), backticks) in application logs related to codebase operations
• Unexpected child processes spawned by the codebase-mcp service
• File system modifications or network connections initiated by the codebase-mcp process that deviate from normal behavior

Detection Strategies

• Monitor process execution chains for Node.js spawning unexpected shell commands or child processes
• Implement application-level logging to capture all inputs to getCodebase, getRemoteCodebase, and saveCodebase functions
• Deploy endpoint detection rules to identify command injection patterns in process command lines
• Review audit logs for privilege escalation attempts following suspicious codebase-mcp activity

Monitoring Recommendations

• Enable verbose logging for the codebase-mcp application and forward logs to a SIEM solution
• Configure SentinelOne Singularity Platform to monitor for anomalous process behavior from Node.js applications
• Establish baseline behavior for codebase-mcp operations and alert on deviations
• Monitor for reconnaissance commands commonly executed post-exploitation (e.g., whoami, id, uname)

How to Mitigate CVE-2026-5023

Immediate Actions Required

• Restrict local access to systems running codebase-mcp to only authorized personnel
• Consider disabling or removing the codebase-mcp tool until a patch is available
• Implement network segmentation to limit the impact of potential compromise
• Review and audit recent usage of codebase-mcp for signs of exploitation

Patch Information

As of the last update on 2026-03-30, no official patch has been released. The codebase-mcp project uses a rolling release model, meaning version-specific patch information is unavailable. The project maintainers were notified through a GitHub issue but have not yet responded. Monitor the project repository for updates.

Workarounds

• Fork the repository and implement input sanitization in src/tools/codebase.ts before the vulnerable functions execute shell commands
• Use a wrapper script or reverse proxy to validate and sanitize inputs before they reach the codebase-mcp service
• Run codebase-mcp in an isolated container or sandbox environment with minimal privileges
• Implement strict access controls limiting which users can interact with the codebase-mcp service

# Example: Run codebase-mcp in a restricted container
docker run --rm \
  --read-only \
  --security-opt=no-new-privileges \
  --cap-drop=ALL \
  -u nobody:nogroup \
  codebase-mcp-image