CVE-2026-7730: privsim mcp-test-runner RCE Vulnerability

CVE-2026-7730 Overview

CVE-2026-7730 is an operating system command injection vulnerability in privsim mcp-test-runner version 0.2.0. The flaw resides in the child_process.spawn call within src/index.ts of the Model Context Protocol (MCP) Interface component. An authenticated remote attacker can manipulate the command argument to inject arbitrary operating system commands. A public exploit is available, increasing the likelihood of opportunistic attacks. The maintainers were notified through a GitHub issue but have not yet responded with a fix.

Critical Impact
Remote attackers with low privileges can inject arbitrary OS commands through the MCP interface, leading to unauthorized command execution on the host running mcp-test-runner.

Affected Products

privsim mcp-test-runner 0.2.0
Component: MCP Interface (src/index.ts)
Function: child_process.spawn

Discovery Timeline

2026-05-04 - CVE-2026-7730 published to NVD
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-7730

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-77]. It originates in the child_process.spawn invocation inside src/index.ts, which is part of the MCP Interface exposed by mcp-test-runner. The command argument passed to spawn is constructed using attacker-controllable input without adequate sanitization or argument separation.

When spawn is invoked with shell: true or with a command string composed by concatenating untrusted data, shell metacharacters such as ;, &&, |, and backticks are interpreted by the underlying shell. This allows attackers to chain or substitute commands beyond the intent of the application logic.

The attack is reachable over the network via the MCP interface and requires only low privileges. A working exploit has been disclosed publicly, lowering the barrier to abuse.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The mcp-test-runner accepts a command parameter from MCP requests and forwards it to child_process.spawn without validating, escaping, or restricting it to an allowlist. Because Node.js spawn executes through a shell when invoked with a single string and shell option, attacker-supplied metacharacters break out of the intended argument context.

Attack Vector

The attack vector is network-based. An authenticated client of the MCP interface submits a crafted request containing shell metacharacters within the command field. The injected payload executes with the privileges of the mcp-test-runner process. Refer to the VulDB entry #360905 and the public exploit issue for technical details on the request structure.

Detection Methods for CVE-2026-7730

Indicators of Compromise

Unexpected child processes spawned by the Node.js process running mcp-test-runner, particularly shells such as sh, bash, or cmd.exe.
MCP request logs containing shell metacharacters (;, &&, ||, |, `, $()) within the command parameter.
Outbound network connections initiated by mcp-test-runner to untrusted hosts shortly after MCP requests are processed.

Detection Strategies

Inspect application logs for MCP requests where the command argument contains shell metacharacters or chained operators.
Use endpoint telemetry to alert on node parent processes spawning interactive shells or system administration utilities (curl, wget, nc, powershell).
Compare runtime process trees against an allowlist of expected test commands defined for the deployment.

Monitoring Recommendations

Forward MCP server logs and process creation events to a centralized SIEM for correlation.
Establish a baseline of legitimate test commands executed by mcp-test-runner and alert on deviations.
Monitor the upstream project repository for a patched release and the related issue thread.

How to Mitigate CVE-2026-7730

Immediate Actions Required

Remove mcp-test-runner 0.2.0 from production and untrusted-network-accessible environments until a fix is published.
Restrict access to the MCP interface using network-layer controls and require strong authentication for any client connection.
Run the service under a dedicated low-privilege user account with no write access to sensitive directories.

Patch Information

No official patch is available at the time of publication. The maintainers were notified through the project issue tracker but have not yet responded. Track the project repository and VulDB advisory #360905 for updates.

Workarounds

Apply a local fork that replaces the vulnerable child_process.spawn invocation with an array-form call and shell: false, validating each argument against an allowlist.
Wrap the MCP interface behind a reverse proxy that enforces strict input validation and rejects requests containing shell metacharacters in the command field.
Isolate mcp-test-runner inside a container or sandbox with seccomp, AppArmor, or SELinux policies that block execution of unexpected binaries.

bash

# Example: run mcp-test-runner under a restricted user with no shell access
sudo useradd --system --shell /usr/sbin/nologin mcprunner
sudo -u mcprunner node /opt/mcp-test-runner/dist/index.js