CVE-2026-7642 Overview
CVE-2026-7642 is an operating system command injection vulnerability in the pskill9 website-downloader project up to version 0.1.0. The flaw resides in the download_website function of src/index.ts within the Model Context Protocol (MCP) Interface component. Attackers manipulate the outputPath argument to inject arbitrary shell commands. The exploit is publicly available, and the project maintainer has not responded to the issue report. The vulnerability is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command.
Critical Impact
Remote attackers with low privileges can inject operating system commands through the outputPath parameter, leading to unauthorized command execution on the host running the MCP server.
Affected Products
- pskill9 website-downloader versions up to and including 0.1.0
- The download_website function in src/index.ts
- MCP Interface component consuming the outputPath argument
Discovery Timeline
- 2026-05-02 - CVE-2026-7642 published to the National Vulnerability Database (NVD)
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-7642
Vulnerability Analysis
The vulnerability is an OS command injection flaw in the download_website handler exposed through the MCP Interface. When a client invokes the tool, the outputPath argument is incorporated into a shell command without proper neutralization of metacharacters. An attacker who can submit MCP requests can append shell operators such as ;, &&, or backticks to outputPath and execute arbitrary commands in the context of the process running the website-downloader server.
The attack is initiated remotely over the network and requires only low-level privileges to interact with the MCP endpoint. No user interaction is necessary. Public proof-of-concept material has been referenced through the GitHub Issue Discussion and the VulDB Vulnerability Info entries. The Exploit Prediction Scoring System (EPSS) places this issue at the 76th percentile, indicating measurable real-world exploitation likelihood despite the limited deployment footprint.
Root Cause
The root cause is the unsafe construction of a shell command string using the user-controlled outputPath argument. The download_website function passes this string to a shell-invoking API without escaping or validating input. Because the MCP server trusts arguments forwarded by connected clients, any actor able to reach the MCP transport can supply crafted values.
Attack Vector
An attacker reaches the MCP Interface over the network, calls the download_website tool, and supplies an outputPath value containing shell metacharacters. The injected commands execute with the same privileges as the website-downloader process. Successful exploitation enables file modification, data exfiltration, and pivot opportunities into the host environment. See the GitHub Repository Overview and the GitHub Issue Tracker for code-level context.
Detection Methods for CVE-2026-7642
Indicators of Compromise
- Unexpected child processes spawned by the Node.js runtime hosting the website-downloader MCP server, particularly sh, bash, cmd.exe, or powershell.exe.
- MCP download_website requests where the outputPath argument contains shell metacharacters such as ;, |, &, backticks, or $().
- Outbound network connections originating from the website-downloader process to hosts outside the expected download targets.
Detection Strategies
- Inspect MCP tool invocation logs for anomalous outputPath values that deviate from filesystem path patterns.
- Apply behavioral monitoring on processes hosting MCP servers to flag command shell descendants.
- Correlate process creation telemetry with MCP request logs to attribute spawned shells to specific tool calls.
Monitoring Recommendations
- Forward Node.js process telemetry and MCP request logs to a centralized analytics platform for correlation.
- Alert on file writes to sensitive paths such as /etc, ~/.ssh, or Windows startup folders by the website-downloader process.
- Monitor for new persistence artifacts (cron jobs, scheduled tasks, systemd units) created after MCP traffic spikes.
How to Mitigate CVE-2026-7642
Immediate Actions Required
- Stop exposing the pskill9 website-downloader MCP server on untrusted networks until a patch is available.
- Restrict MCP client access to authenticated, trusted local processes only.
- Audit historical MCP request logs for suspicious outputPath arguments and investigate any matches.
- Run the MCP server under a dedicated, low-privileged service account with no write access to system directories.
Patch Information
No official patch has been released. According to the CVE record, the project was informed through an issue report but has not responded. Track the GitHub Issue Tracker and the VulDB Vulnerability Info for updates. Until a fix is published, treat all 0.x releases of website-downloader as vulnerable.
Workarounds
- Fork the project and replace shell-invoking download logic with a library API that does not spawn a shell, eliminating metacharacter interpretation.
- Wrap the download_website handler with an input validator that rejects outputPath values containing characters outside [A-Za-z0-9._/\-].
- Run the MCP server inside a container or sandbox with read-only filesystem mounts and egress filtering to limit blast radius.
- Disable the download_website tool entirely if downstream consumers do not require it.
# Configuration example: restrict MCP server with systemd hardening
[Service]
User=mcp-downloader
ProtectSystem=strict
ReadWritePaths=/var/lib/website-downloader
NoNewPrivileges=true
PrivateTmp=true
RestrictAddressFamilies=AF_INET AF_INET6
SystemCallFilter=@system-service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
