CVE-2026-7812: code-mcp RCE Vulnerability

CVE-2026-7812 Overview

CVE-2026-7812 is a command injection vulnerability in the 54yyyu code-mcp project, a Model Context Protocol (MCP) tool implementation. The flaw resides in the git_operation function within src/code_mcp/server.py. Attackers can manipulate the operation argument to inject arbitrary operating system commands. The issue is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The exploit has been disclosed publicly and can be triggered remotely without authentication. Because the project follows a continuous delivery model with rolling releases, no specific affected or fixed version identifiers are available.

Critical Impact

Remote attackers can inject arbitrary commands through the operation parameter of the MCP git_operation tool, leading to unauthorized command execution on the host running the MCP server.

Affected Products

• 54yyyu code-mcp up to commit 4cfc4643541a110c906d93635b391bf7e357f4a8
• Component: MCP Tool — git_operation function in src/code_mcp/server.py
• Distribution model: continuous delivery with rolling releases (no discrete versioning)

Discovery Timeline

• 2026-05-05 - CVE-2026-7812 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7812

Vulnerability Analysis

The vulnerability exists in the git_operation function exposed by the MCP server in src/code_mcp/server.py. The function accepts an operation argument intended to specify a Git action. The implementation passes this argument into a downstream command execution path without sufficient neutralization of shell metacharacters or command separators. As a result, an attacker controlling the value of operation can append additional commands that the host shell will interpret and execute.

MCP servers act as bridges between AI assistants and local developer tooling. A successful exploit therefore enables an attacker to run shell commands within the runtime context of the MCP host process, with the privileges of that process.

Root Cause

The root cause is improper neutralization of input passed to a command interpreter, consistent with [CWE-74]. The git_operation handler treats attacker-controllable input as part of a command string rather than a discrete argument. Without strict allowlisting, argument array construction, or shell escaping, the operation parameter becomes a direct injection sink.

Attack Vector

The attack vector is network-reachable when the MCP tool is exposed to a client capable of invoking the git_operation tool with attacker-supplied parameters. The attacker submits a crafted operation value that contains shell metacharacters such as ;, &&, |, or backticks. The injected payload executes alongside or in place of the intended Git command. No authentication is required, and user interaction is not necessary to trigger the flaw. The exploit has been made public, increasing the likelihood of opportunistic abuse against exposed instances.

No verified proof-of-concept code is reproduced here. See the GitHub Issue Tracker and the VulDB Vulnerability Detail for technical references.

Detection Methods for CVE-2026-7812

Indicators of Compromise

• Unexpected child processes spawned by the code-mcp server process, particularly shells (/bin/sh, bash, cmd.exe) launched outside of normal Git workflows.
• MCP request payloads to the git_operation tool containing shell metacharacters such as ;, |, &&, $(), or backticks in the operation field.
• Outbound network connections originating from the MCP host to unfamiliar destinations shortly after git_operation invocations.
• New or modified files in the repository working directory or user home directory that do not correspond to legitimate Git activity.

Detection Strategies

• Enable verbose logging of all MCP tool invocations and capture the full operation argument for retrospective inspection.
• Apply process-tree analytics to flag any descendants of the code-mcp Python process that are not git itself.
• Inspect HTTP or stdio transport traffic to the MCP server for parameter values containing command separators or substitution syntax.

Monitoring Recommendations

• Forward MCP server logs and host endpoint telemetry to a centralized analytics platform for correlation.
• Alert on Python interpreter processes invoking os.system, subprocess with shell=True, or spawning interactive shells.
• Track baseline command frequencies for the MCP host and alert on deviations following deployments or configuration changes.

How to Mitigate CVE-2026-7812

Immediate Actions Required

• Restrict network exposure of the code-mcp server to trusted local clients only; do not expose it to untrusted networks.
• Run the MCP server under a dedicated low-privilege user account with no write access to sensitive repositories or credentials.
• Audit recent git_operation invocations for suspicious operation values and investigate any anomalies.
• Track the upstream GitHub Issue Tracker for maintainer response and pull the latest commit once a fix is published.

Patch Information

No patch is currently available. The maintainer of 54yyyu/code-mcp was notified through an issue report but has not responded at the time of disclosure. Because the project uses rolling releases, remediation will require pulling the upstream commit that addresses the injection once published. Monitor the GitHub Code Repository for fix commits.

Workarounds

• Disable or remove the git_operation tool from the MCP server configuration until a fix is released.
• If self-maintaining a fork, replace shell-based command execution in git_operation with subprocess.run using an argument list and shell=False, and validate operation against a strict allowlist of permitted Git subcommands.
• Sandbox the MCP server using container isolation, seccomp, or AppArmor profiles to limit the impact of command execution.
• Apply egress network filtering on the MCP host to constrain exfiltration paths if exploitation occurs.

# Example hardening: run code-mcp inside a restricted container with no shell access
docker run --rm \
  --user 65534:65534 \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --network=none \
  -v /srv/repos:/repos:ro \
  code-mcp:pinned-commit