CVE-2026-7653: mcp-server-rijksmuseum RCE Vulnerability

CVE-2026-7653 Overview

CVE-2026-7653 is an operating system (OS) command injection vulnerability in the r-huijts mcp-server-rijksmuseum Model Context Protocol (MCP) server through version 1.0.4. The flaw resides in the open_image_in_browser function within src/index.ts, where the imageUrl argument is passed to a shell context without sanitization. An attacker who can reach the MCP interface and supply a crafted imageUrl can execute arbitrary OS commands on the host running the server. The exploit has been disclosed publicly, and the maintainer has not responded to the upstream issue report at the time of publication. The weakness is tracked as [CWE-77].

Critical Impact
Remote attackers with low privileges can inject arbitrary OS commands via the imageUrl parameter, leading to unauthorized command execution on the host running the MCP server.

Affected Products

r-huijts mcp-server-rijksmuseum versions up to and including 1.0.4
The open_image_in_browser function in src/index.ts
MCP Interface component exposed by the server

Discovery Timeline

2026-05-02 - CVE-2026-7653 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7653

Vulnerability Analysis

The mcp-server-rijksmuseum project implements a Model Context Protocol server that exposes tools to AI clients, including a helper that opens artwork images in the user's default browser. The open_image_in_browser tool accepts an imageUrl argument from the MCP client and forwards it to a shell-invoking API. Because the input is concatenated into a command line without escaping or allowlist validation, shell metacharacters such as ;, &&, |, and backticks are interpreted by the underlying shell. An attacker who controls the MCP request payload can therefore append arbitrary commands to the intended browser-launch command.

The issue is reachable over the network through the MCP transport, so any client allowed to invoke tools on the server can trigger the flaw. Successful exploitation runs commands with the privileges of the Node.js process hosting the MCP server.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The imageUrl parameter is treated as a trusted string and embedded directly into a shell command rather than being passed through a parameterized API such as child_process.execFile with an argument array, or validated against a strict URL allowlist.

Attack Vector

Exploitation requires the attacker to reach the MCP interface and invoke the open_image_in_browser tool with an imageUrl payload containing shell metacharacters. The attack is remote, low-complexity, and requires only low privileges on the MCP channel. No user interaction is needed once the malicious tool call is dispatched. Because MCP servers are commonly run on developer workstations connected to AI assistants, a malicious or compromised client, or a prompt-injection chain that influences the AI client, can drive the exploitation path.

No verified public exploit code is included here. Refer to the GitHub Issue Report and VulDB Vulnerability #360778 for additional technical context.

Detection Methods for CVE-2026-7653

Indicators of Compromise

Child processes spawned by the Node.js MCP server process that are not browser binaries (for example sh, bash, cmd.exe, powershell.exe, curl, wget).
MCP request logs containing open_image_in_browser invocations whose imageUrl argument includes shell metacharacters such as ;, |, &, $(, or backticks.
Outbound network connections from the MCP server host to unexpected destinations following a tool call.

Detection Strategies

Inspect MCP server access and tool-call logs for open_image_in_browser calls and validate that imageUrl values match a strict URL pattern.
Monitor process lineage on hosts running the MCP server and alert when the Node runtime spawns shells or scripting interpreters.
Apply endpoint behavioral detection rules that flag command-injection patterns originating from developer tooling and AI assistant integrations.

Monitoring Recommendations

Forward Node.js MCP server logs and host process telemetry to a centralized logging or SIEM platform for correlation.
Track installations of mcp-server-rijksmuseum across developer endpoints and confirm the deployed version.
Review AI assistant conversation logs for prompt content that could coerce a client into invoking open_image_in_browser with attacker-controlled URLs.

How to Mitigate CVE-2026-7653

Immediate Actions Required

Stop and uninstall mcp-server-rijksmuseum versions up to 1.0.4 on any developer or production host until a fixed release is available.
Restrict MCP server exposure to trusted local clients only, and do not bind the server to network interfaces reachable by untrusted users.
Audit AI assistant configurations to remove the open_image_in_browser tool from the allowed tool set until the project ships a patch.

Patch Information

No vendor patch is available at the time of publication. The project maintainer was notified through the upstream GitHub Issue Report but has not responded. Track the VulDB Vulnerability #360778 entry and the project repository for an updated release beyond 1.0.4.

Workarounds

Fork the project and replace the shell-based browser invocation with child_process.execFile using an argument array, or with a vetted library such as open configured to disallow shell interpretation.
Validate the imageUrl argument against an allowlist that requires https:// URLs pointing only to expected Rijksmuseum image domains.
Run the MCP server under a least-privilege user account with no shell access and outbound network egress filtering to limit the impact of successful injection.

bash

# Configuration example: remove the vulnerable package and restrict execution
npm uninstall mcp-server-rijksmuseum

# Run remaining MCP servers under a dedicated unprivileged user
useradd -r -s /usr/sbin/nologin mcpsvc
sudo -u mcpsvc node /opt/mcp/your-trusted-server.js