CVE-2026-7629: awesome-cursor-mpc-server RCE Vulnerability

CVE-2026-7629 Overview

CVE-2026-7629 is a command injection vulnerability in kleneway/awesome-cursor-mpc-server versions up to 2.0.1. The flaw resides in the runCodeReviewTool function within src/tools/codeReview.ts, part of the Code-Review Tool component. Attackers can manipulate input to inject and execute arbitrary operating system commands remotely. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). A public exploit has been disclosed, and the project maintainer was notified through a pull request but has not yet remediated the issue.

Critical Impact
Remote attackers with low privileges can inject operating system commands through the code review tool, leading to unauthorized command execution on the host running the MCP server.

Affected Products

kleneway/awesome-cursor-mpc-server versions up to and including 2.0.1
The runCodeReviewTool function in src/tools/codeReview.ts
Code-Review Tool component of the MCP (Model Context Protocol) server

Discovery Timeline

2026-05-02 - CVE-2026-7629 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7629

Vulnerability Analysis

The vulnerability exists in the runCodeReviewTool function defined in src/tools/codeReview.ts. The function processes input parameters and passes them to a shell execution context without sufficient sanitization. An attacker can craft input containing shell metacharacters to break out of the intended command context. This permits execution of arbitrary commands under the privileges of the MCP server process. The flaw is reachable over the network and requires only low-level privileges to exploit.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream component, mapped to [CWE-74]. The runCodeReviewTool implementation concatenates or interpolates user-controlled input directly into a command string. Shell metacharacters such as ;, &&, |, and backticks are not escaped or filtered. As a result, the underlying shell interprets attacker-supplied data as additional commands rather than literal arguments.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker invokes the code review tool endpoint with crafted parameters containing shell injection payloads. When runCodeReviewTool constructs and executes the underlying shell command, the injected payload runs in the same process context. The exploit has been published, increasing the likelihood of opportunistic abuse against exposed instances.

A detailed proof-of-concept is documented in the GitHub Issue Report and the Bug Report PDF. A proposed fix is available in the GitHub Pull Request.

Detection Methods for CVE-2026-7629

Indicators of Compromise

Unexpected child processes spawned by the Node.js process running awesome-cursor-mpc-server, especially sh, bash, cmd.exe, or powershell.exe.
Outbound network connections initiated from the MCP server host to unfamiliar IP addresses or domains shortly after a code review request.
Anomalous arguments containing shell metacharacters such as ;, |, &&, or backticks in MCP server request logs.
New or modified files in temporary directories or write access outside the project workspace.

Detection Strategies

Inspect application logs for calls to runCodeReviewTool containing non-alphanumeric characters in input fields.
Use endpoint detection tooling to flag unusual process trees descending from the Node.js runtime hosting the MCP server.
Apply [CWE-74] command injection detection signatures in web application firewalls or runtime application self-protection (RASP) tools.

Monitoring Recommendations

Enable verbose logging for the MCP server and forward logs to a centralized SIEM for correlation.
Monitor for execution of system binaries such as curl, wget, nc, or whoami from the MCP server context.
Track file integrity on the directory containing src/tools/codeReview.ts and configuration files.

How to Mitigate CVE-2026-7629

Immediate Actions Required

Restrict network exposure of the MCP server to trusted localhost or authenticated internal networks only.
Run the MCP server under a least-privilege account that cannot access sensitive files or escalate privileges.
Apply the changes proposed in the GitHub Pull Request #14 to local forks if an official release is unavailable.

Patch Information

At the time of publication, the project maintainer has not released an official patch. A community pull request addressing the issue is pending review at GitHub Pull Request #14. Operators should track the GitHub Project Repository for updates and consider applying the proposed fix manually.

Workarounds

Replace shell-based command execution with parameterized APIs such as Node.js child_process.execFile and an explicit argument array.
Validate and sanitize all input passed to runCodeReviewTool using strict allow-lists for file paths and command parameters.
Disable or remove the Code-Review Tool component if it is not required in production deployments.
Place the MCP server behind a reverse proxy enforcing authentication and request inspection.

bash

# Configuration example: run the MCP server under a restricted user with reduced shell access
useradd -r -s /usr/sbin/nologin mcpserver
chown -R mcpserver:mcpserver /opt/awesome-cursor-mpc-server
sudo -u mcpserver node /opt/awesome-cursor-mpc-server/dist/index.js