Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directory/create_rule of the file src/index.ts of the component MCP Interface. The manipulation of the argument ID results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.1 is able to mitigate this issue. The patch is identified as 141335da044e53c3f5b315e0386e01238405b771. It is advisable to upgrade the affected component.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-30 | 4 | Disclosure3General1 |
| 2026-05-02 | 1 | Patch1 |
⚙️ CVE-2026-7446: OS command injection in VetCoders mcp-server-semgrep 1.0.0 due to improper handling of the ID argument in the MCP interface. #CommandInjection #MCP #Security #CVE https://nvd.nist.gov/vuln/detail/CVE-2026-7446
Post summary
A new OS command injection vulnerability (CVE‑2026‑7446) in VetCoders mcp‑server‑semgrep v1.0.0 has been disclosed, describing the improper handling of an ID argument.
Command injection in MCP servers. Not surprised. CVE-2026-7446 hits mcp-server-semgrep, and CVE-2026-7416 hits xcode-mcp-server. Both let remote attackers inject OS commands with no auth needed. The attack surface on MCP servers keeps growing, and most of these community-built tools were never designed with security in mind. mcp-server-semgrep has a fix in v1.0.1, but who's checking their MCP server versions? Nobody. That's the problem. https://nvd.nist.gov/vuln/detail/CVE-2026-7446
Post summary
The post identifies two command injection vulnerabilities in MCP servers, notes a published patch for one, and criticizes the lack of version checks, without indicating active exploitation or PoC details.
CVE-2026-7446 Remote OS Command Injection in VetCoders mcp-server-semgrep 1.0.0 MCP Interface https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7446
Post summary
A remote OS command injection vulnerability has been identified in VetCoders mcp-server-semgrep 1.0.0. No PoC, exploit code, active exploitation, or patch information was provided.
🚨*CVE* CVE-2026-7446 A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directo… https://www.cve.org/CVERecord?id=CVE-2026-7446 ----- Traducción: CVE-2026-7446 Se … http://infoflow.cloud`
Post summary
The post announces CVE-2026-7446 as affecting certain VetCoders functions but gives no additional technical, exploit, or mitigation details.
CVE-2026-7446 A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directo… https://www.cve.org/CVERecord?id=CVE-2026-7446
Post summary
A new CVE-2026-7446 vulnerability was reported for VetCoders mcp-server-semgrep 1.0.0 affecting several functions, but no PoC, exploit, active exploitation, patch, or technical details are provided.