CVE-2026-7446: VetCoders mcp-server-semgrep RCE Flaw

CVE-2026-7446 Overview

A critical OS command injection vulnerability has been identified in VetCoders mcp-server-semgrep version 1.0.0. This vulnerability affects multiple functions within the MCP Interface component, specifically analyze_results, filter_results, export_results, compare_results, scan_directory, and create_rule in the file src/index.ts. The manipulation of the ID argument enables remote attackers to execute arbitrary operating system commands on vulnerable systems.

Critical Impact
Remote attackers can exploit this command injection vulnerability to execute arbitrary OS commands, potentially leading to complete system compromise, data theft, or lateral movement within the network.

Affected Products

VetCoders mcp-server-semgrep 1.0.0
MCP Interface component (src/index.ts)

Discovery Timeline

2026-04-30 - CVE CVE-2026-7446 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-7446

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly known as Command Injection. The affected component fails to properly sanitize user-supplied input in the ID argument before passing it to OS command execution functions. When an attacker provides malicious input containing shell metacharacters or command separators, these are processed by the underlying shell, allowing arbitrary command execution.

The vulnerability impacts six distinct functions within the MCP Interface: analyze_results, filter_results, export_results, compare_results, scan_directory, and create_rule. Each of these functions accepts an ID parameter that is subsequently used in command construction without adequate input validation or sanitization.

Root Cause

The root cause of this vulnerability lies in the improper handling of user-controlled input within the src/index.ts file. The affected functions directly incorporate the ID argument into shell commands without implementing proper input validation, escaping, or parameterization. This allows attackers to inject shell metacharacters (such as ;, |, &&, or backticks) to break out of the intended command context and execute arbitrary commands.

Attack Vector

The vulnerability can be exploited remotely through the MCP Interface. An attacker can craft malicious requests containing specially crafted ID values that include OS command injection payloads. When the vulnerable functions process these malicious IDs, the injected commands are executed with the privileges of the application process.

The exploit for this vulnerability is publicly available, increasing the risk of active exploitation in the wild. Attack scenarios include:

Injecting commands to exfiltrate sensitive data from the server
Establishing reverse shells for persistent access
Modifying or deleting critical files
Using the compromised system as a pivot point for lateral movement

The security patch addressed this issue by implementing proper input validation and migrating to a modern ESLint configuration:

javascript

+import typescriptEslint from '@typescript-eslint/eslint-plugin';
+import typescriptParser from '@typescript-eslint/parser';
+
+export default [
+  {
+    ignores: ['build/**', 'node_modules/**'],
+  },
+  {
+    files: ['src/**/*.ts', 'tests/**/*.ts'],
+    languageOptions: {
+      parser: typescriptParser,
+      parserOptions: {
+        ecmaVersion: 2022,
+        sourceType: 'module',
+      },
+      globals: {
+        Buffer: 'readonly',
+        console: 'readonly',
+        process: 'readonly',
+      },
+    },
+    plugins: {
+      '@typescript-eslint': typescriptEslint,
+    },
+    rules: {
+      ...typescriptEslint.configs.recommended.rules,
+      indent: ['error', 2],
+      'linebreak-style': ['error', 'unix'],
+      quotes: ['error', 'single', { avoidEscape: true }],
+      semi: ['error', 'always'],

Source: GitHub Commit Details

Detection Methods for CVE-2026-7446

Indicators of Compromise

Unusual process spawning from the mcp-server-semgrep application, particularly shell processes (/bin/sh, /bin/bash, cmd.exe)
Network connections originating from the semgrep server process to unexpected external destinations
Suspicious command patterns in application logs containing shell metacharacters (;, |, &&, $(), backticks)
Unexpected file system modifications or new files created by the application process

Detection Strategies

Monitor application logs for ID parameters containing shell metacharacters or command injection patterns
Implement web application firewall (WAF) rules to detect and block command injection payloads in API requests
Deploy endpoint detection and response (EDR) solutions to identify anomalous child process creation from the application
Enable system auditing to track process execution chains and detect unauthorized command execution

Monitoring Recommendations

Configure centralized logging for all mcp-server-semgrep instances and analyze for injection patterns
Set up alerts for process execution anomalies where the parent process is the vulnerable application
Monitor outbound network traffic from application servers for suspicious connections indicating reverse shells
Implement file integrity monitoring on critical system directories to detect unauthorized modifications

How to Mitigate CVE-2026-7446

Immediate Actions Required

Upgrade VetCoders mcp-server-semgrep to version 1.0.1 immediately to apply the security patch
Audit logs for any signs of exploitation attempts targeting the ID parameter
Implement network segmentation to limit the blast radius if exploitation has occurred
Apply input validation at the network perimeter using WAF rules while planning the upgrade

Patch Information

The vulnerability has been addressed in mcp-server-semgrep version 1.0.1. The security fix is identified by commit hash 141335da044e53c3f5b315e0386e01238405b771. Organizations should upgrade to the patched version as soon as possible. For detailed information, refer to the GitHub Release v1.0.1 and the GitHub Pull Request that introduced the fix.

Workarounds

Restrict network access to the MCP Interface to trusted IP addresses only until patching is complete
Implement strict input validation at the application gateway level to filter potentially malicious ID values
Deploy application-level firewalls configured to detect and block OS command injection patterns
Consider temporarily disabling the affected functions (analyze_results, filter_results, export_results, compare_results, scan_directory, create_rule) if operationally feasible

bash

# Example: Restrict network access to MCP Interface using iptables
iptables -A INPUT -p tcp --dport <MCP_PORT> -s <TRUSTED_IP_RANGE> -j ACCEPT
iptables -A INPUT -p tcp --dport <MCP_PORT> -j DROP