Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-23 | 1 | Patch1 |
| 2026-04-26 | 2 | Disclosure1PoC1 |
| 2026-07-16 | 1 | General1 |
My findings: CVE-2026-6942 (radare2-mcp, CVSS 9.8), CVE-2026-42449 (n8n-mcp, CVSS 8.5), CVE-2026-35394 (mobile-mcp, CVSS 8.3). Plus issues in GitHub MCP, Kubernetes MCP, IDA Pro MCP, Chromium DevTools MCP, and AWS Diagram MCP.
Post summary
The post enumerates several high‑CVSS CVEs across various MCP tools but does not provide evidence of exploitation, PoC, or remediation.
Full writeup + PoC: http://github.com/manthanghasadiya/writeups/tree/main/CVE-2026-6942 Found with mcpsec, my open-source MCP security scanner: http://github.com/manthanghasadiya/mcpsec CVE record: http://cve.org/CVERecord?id=CVE-2026-6942
Post summary
The text announces a writeup and PoC for CVE‑2026‑6942, providing a link to functional exploit code, but does not mention active exploitation, patches, or technical details.
Security researchers: "Let me have my AI analyze this suspicious binary." The binary: *contains r2.cmd("!id")* Your terminal: uid=1000(researcher) gid=1000(researcher) CVE-2026-6942. CVSS 9.8. Full writeup below 🧵 https://t.co/OmTRV0gm8G
Post summary
Researchers posted a binary illustrating CVE-2026-6942, noting a CVSS score of 9.8, but no exploit code, patch info, or claims of active exploitation are provided.
🚨 CVE-2026-6942 — CVSS 9.8/10 ██████████ radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/FKFEUB21pp
Post summary
CVE-2026-6942 is a critical OS command injection flaw in radare2-mcp 1.6.0 and earlier; a patch is available.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | radare | radare2_mcp_server | - | - | - |