CVE-2026-7064: AgentDeskAI Browser-Tools-MCP RCE Flaw

CVE-2026-7064 Overview

A critical OS command injection vulnerability has been identified in AgentDeskAI browser-tools-mcp versions up to and including 1.2.0. The flaw exists in the browser-tools-server/browser-connector.ts file, where improper input handling allows remote attackers to inject and execute arbitrary operating system commands. This vulnerability poses a significant risk as it can be exploited remotely without authentication, potentially allowing attackers to gain unauthorized access to the underlying system.

Critical Impact
Remote attackers can execute arbitrary OS commands on systems running vulnerable versions of browser-tools-mcp, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Affected Products

AgentDeskAI browser-tools-mcp versions up to 1.2.0
Systems utilizing browser-tools-server with browser-connector.ts component
MCP (Model Context Protocol) deployments integrating vulnerable browser-tools

Discovery Timeline

2026-04-26 - CVE-2026-7064 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7064

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly known as Command Injection. The vulnerable component, browser-connector.ts, fails to properly sanitize user-controlled input before passing it to system command execution functions. This allows an attacker to craft malicious input containing shell metacharacters or command separators that escape the intended command context and execute arbitrary commands on the host operating system.

The network-accessible nature of this vulnerability significantly increases its exploitability, as attackers do not require local access or authentication to trigger the flaw. According to the CVE report, an exploit has been publicly disclosed and may be actively used in the wild.

Root Cause

The root cause of CVE-2026-7064 stems from insufficient input validation and sanitization in the browser-connector.ts file within the browser-tools-server component. When processing external input, the application constructs system commands by directly concatenating user-supplied data without proper escaping or parameterization. This architectural weakness allows specially crafted input to break out of the intended command structure and inject additional commands.

Attack Vector

The attack can be performed remotely over the network without requiring user interaction or prior authentication. An attacker would craft a malicious request containing OS command injection payloads targeting the vulnerable browser-connector.ts processing logic. Common injection techniques include:

Using command separators such as ;, &&, or || to chain malicious commands
Employing shell metacharacters like backticks or $() for command substitution
Leveraging newline characters to terminate the original command and inject new ones

The vulnerability manifests when user-controlled input is passed to command execution functions without proper sanitization. Attackers can exploit this by injecting shell metacharacters or command separators to escape the intended command context. For detailed technical information, refer to the GitHub Issue Tracker and VulDB vulnerability entry.

Detection Methods for CVE-2026-7064

Indicators of Compromise

Unusual child processes spawned by the browser-tools-server application, particularly shells like /bin/sh, /bin/bash, or cmd.exe
Unexpected network connections originating from the browser-tools-mcp process
Log entries showing malformed requests containing shell metacharacters such as ;, |, &&, or backticks
File system modifications or new files created in unexpected locations by the server process

Detection Strategies

Implement network-level monitoring for requests to browser-tools-mcp endpoints containing command injection patterns
Deploy endpoint detection and response (EDR) solutions to monitor for anomalous process execution chains
Configure web application firewalls (WAF) to detect and block requests containing OS command injection payloads
Enable detailed logging on the browser-tools-server to capture and analyze suspicious input patterns

Monitoring Recommendations

Monitor process creation events for child processes spawned by the browser-tools-mcp application
Implement alerting for outbound network connections from the server process to unexpected destinations
Review application logs regularly for signs of injection attempts or error messages indicating malformed input
Track file system changes in directories accessible to the browser-tools-server process

How to Mitigate CVE-2026-7064

Immediate Actions Required

Assess your environment for deployments of AgentDeskAI browser-tools-mcp versions 1.2.0 and earlier
Implement network-level access controls to restrict exposure of the vulnerable service to trusted networks only
Deploy web application firewall rules to filter potential command injection payloads
Monitor for exploitation attempts using the detection strategies outlined above
Consider disabling or isolating the vulnerable component until a patch is available

Patch Information

At the time of this publication, the vendor has been notified through a GitHub issue report but has not yet responded with a security patch. Organizations should monitor the AgentDeskAI browser-tools-mcp repository for updates and apply any security patches immediately upon release.

Workarounds

Restrict network access to the browser-tools-mcp service using firewall rules to allow only trusted IP addresses
Implement a reverse proxy with strict input validation to filter malicious requests before they reach the vulnerable component
Run the browser-tools-server in a sandboxed environment or container with minimal privileges to limit the impact of successful exploitation
Disable the vulnerable functionality in browser-connector.ts if it is not critical to your operations

bash

# Example: Restrict network access using iptables
# Allow access only from trusted management network
iptables -A INPUT -p tcp --dport <browser-tools-port> -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <browser-tools-port> -j DROP

# Example: Run container with restricted capabilities
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE \
  --security-opt=no-new-privileges \
  --read-only \
  browser-tools-mcp:latest