CVE-2026-7628: mcp-code-review-server RCE Vulnerability

CVE-2026-7628 Overview

CVE-2026-7628 is a command injection vulnerability in the crazyrabbitLTC mcp-code-review-server project up to version 0.1.0. The flaw resides in the executeRepomix function within src/repomix.ts, part of the RepoMix Command Handler component. An authenticated remote attacker can manipulate input passed to this function to inject arbitrary operating system commands. A public exploit exists, and the maintainers were notified through a pull request but have not released a fix at the time of disclosure.

Critical Impact
Remote attackers with low-level privileges can inject arbitrary shell commands through the executeRepomix function, leading to unauthorized command execution on the host running the MCP code review server.

Affected Products

crazyrabbitLTC mcp-code-review-server versions up to and including 0.1.0
The executeRepomix function in src/repomix.ts
The RepoMix Command Handler component

Discovery Timeline

2026-05-02 - CVE-2026-7628 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7628

Vulnerability Analysis

The vulnerability is a command injection issue classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The executeRepomix function in src/repomix.ts builds and executes a shell command using attacker-influenced input without sufficient sanitization. When this input contains shell metacharacters such as ;, &&, |, or backticks, the underlying shell interprets them as command separators and executes additional commands.

The public EPSS probability is 0.924% with a percentile of 76.124, reflecting moderate observed exploitation interest. The exploit code is publicly available, increasing the likelihood of opportunistic abuse against exposed instances.

Root Cause

The root cause is unsafe construction of a shell command string inside executeRepomix. User-controllable parameters are concatenated into the command line passed to a child process executor that invokes a shell. Because the function does not validate or escape input, any metacharacter embedded in the parameter is interpreted by the shell instead of being treated as literal data.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker who can submit a request to the MCP code review server provides crafted input that the executeRepomix handler passes through to a shell. The injected payload runs with the privileges of the Node.js process hosting the MCP server. Confidentiality, integrity, and availability are each affected at a low level under the CVSS 4.0 vector.

No verified proof-of-concept code is reproduced here. Technical details are available in the GitHub Issue Tracker, the GitHub Pull Request, and the Bug Report PDF.

Detection Methods for CVE-2026-7628

Indicators of Compromise

Unexpected child processes spawned by the Node.js process running mcp-code-review-server, particularly shells (/bin/sh, bash, cmd.exe) executing commands not associated with repomix.
Outbound network connections initiated by child processes of the MCP server to unfamiliar destinations.
Log entries in the MCP server showing repository paths or arguments containing shell metacharacters such as ;, &&, |, or backticks.

Detection Strategies

Monitor process trees where node (running mcp-code-review-server) spawns shell interpreters or utilities like curl, wget, nc, or python outside the expected repomix workflow.
Inspect application logs and request payloads for parameters destined for executeRepomix that contain command separators or substitution syntax.
Apply file integrity monitoring on src/repomix.ts and surrounding modules to identify tampering with command construction logic.

Monitoring Recommendations

Enable verbose logging on the MCP server and forward events to a centralized logging or SIEM platform for correlation against process telemetry.
Alert on creation of new files, scheduled tasks, or persistence artifacts by descendants of the MCP server process.
Track network egress from hosts running the MCP server, alerting on connections to non-allowlisted domains or IP addresses.

How to Mitigate CVE-2026-7628

Immediate Actions Required

Restrict network access to the mcp-code-review-server so it is not reachable by untrusted clients; place it behind authenticated, internal-only network paths.
Run the MCP server under a dedicated low-privilege user account inside a sandbox or container with no access to sensitive credentials or data.
Review server logs for prior requests containing shell metacharacters and investigate any matches as potential compromise.

Patch Information

No official patch has been released by the project at the time of publication. A community-submitted GitHub Pull Request proposes a fix, and additional context is tracked in the GitHub Issue Tracker and the VulDB entry #360574. Until the maintainer merges and releases a fix, organizations should treat all versions up to 0.1.0 as vulnerable.

Workarounds

Apply the proposed fix from the open pull request to a local fork and rebuild from source if the MCP server is required for operations.
Replace shell-based command execution in executeRepomix with an array-argument API such as child_process.execFile or spawn without shell: true, ensuring parameters are passed as discrete arguments.
Validate and allowlist input passed to executeRepomix, rejecting any value containing shell metacharacters before invocation.
Disable the affected component or take the service offline if it cannot be patched and is exposed to untrusted input.

bash

# Configuration example: run the MCP server as a restricted user inside a container
# and block outbound traffic except to required destinations.
docker run --rm \
  --user 10001:10001 \
  --read-only \
  --cap-drop=ALL \
  --network=internal-only \
  --name mcp-code-review-server \
  mcp-code-review-server:patched