## https://sploitus.com/exploit?id=B1A35CEC-7673-5025-80C0-82E8CC1DCBE6
# CVE-2026-52616 — mcp-nmap-server: OS command injection via `run_nmap_scan`
The `run_nmap_scan` MCP tool builds its command by string interpolation of the
`target` and `additionalFlags` parameters and runs it through
`child_process.exec`, i.e. `/bin/sh -c`.
> ## ⚠ Read this first — duplicate identifier
>
> **This vulnerability was already public before this CVE ID existed.** It is
> covered by **[CVE-2026-3484](https://nvd.nist.gov/vuln/detail/CVE-2026-3484)
> / [GHSA-xc68-rrqc-qgq3](https://github.com/advisories/GHSA-xc68-rrqc-qgq3)**,
> assigned by VulDB and published 2026-03-03 against `mcp-nmap-server — same package, same CWE-78 `child_process.exec` sink.
>
> CVE-2026-52616 was assigned to s1ko by MITRE CNA-LR on 2026-07-13 in response
> to an independent report. That assignment appears to be a **duplicate**, and
> it has been flagged as such. The pre-existing identifier CVE-2026-3484 is the
> one that should be cited.
>
> This repository is published for completeness and to document the duplicate,
> **not** as a claim of novel discovery. The credit for the original public
> disclosure is not s1ko's.
| | |
|---|---|
| CVE | CVE-2026-52616 — **duplicate of CVE-2026-3484** |
| CWE | CWE-78 (Improper Neutralization of Special Elements used in an OS Command) |
| Package | [`mcp-nmap-server`](https://www.npmjs.com/package/mcp-nmap-server) (npm) |
| Affected | 1.0.1 and earlier — **all published versions** |
| Fixed in | none — repository archived |
| CVSS v3.1 | `AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` = **7.8 High** (stdio transport). `AV:N` → 9.8 Critical if the server is wrapped in a network transport. |
| Independently reported by | s1ko ([github.com/s1ko](https://github.com/s1ko), `s1ko@riseup.net`) |
| CVE assigned | 2026-07-13, MITRE CNA-LR |
A naming trap worth noting for anyone deduplicating this: the npm package is
`mcp-nmap-server` and the repository is `nmap-mcp-server`. The two orderings
refer to the same project.
## Threat model
MCP tool arguments are attacker-influenced. They are produced by an LLM from
the content the agent processes — documents, web pages, tool output — so
indirect prompt injection puts an attacker in control of the values a tool
handler receives. A handler that feeds any of those values into a shell turns
that influence into code execution on the host running the MCP server. This is
the same model as the precedent case `aws-mcp-server` / CVE-2026-5058.
## Execution
`dist/index.js` — the target is appended to a command string which is then
handed to `exec`:
```js
command += ` ${target}`;
…
const { stdout, stderr } = await promisify(exec)(command);
```
`child_process.exec` runs its argument in `/bin/sh -c`, so everything the
caller contributed is shell syntax. The Zod input schema declares `z.string()`,
which validates type and says nothing about content, so metacharacters pass
through. `additionalFlags` reaches the same string by the same route.
A `run_nmap_scan` call with `target` set to
`127.0.0.1; touch /tmp/marker; echo INJECTED` produces:
```
/bin/sh -c "nmap … 127.0.0.1; touch /tmp/marker; echo INJECTED"
```
### Reproduction
[`poc/driver.mjs`](poc/driver.mjs) speaks MCP over stdio: it initializes the
server, issues one `tools/call` for `run_nmap_scan` with an injected `target`,
and checks for a marker file. The payload is a benign `touch`.
```
npm pack mcp-nmap-server@1.0.1
tar xf mcp-nmap-server-1.0.1.tgz && cd package && npm install
node ../poc/driver.mjs
```
Expected on an affected version:
```
==== POC RESULT (mcp-nmap-server) ====
marker /tmp/PWNED_nmap created: true
verdict: CONFIRMED — command injection executed
```
`nmap` does not need to be installed — the injected command runs in the same
`/bin/sh -c` string regardless of whether the leading binary resolves.
Validated 2026-06-01 in an isolated container and re-validated 2026-06-13.
Run it only against infrastructure you are authorized to test.
## Detection
- An `nmap` command line containing `;`, `&&`, `||`, `|`, a backtick or `$(`.
- A `sh -c` process whose command line starts with `nmap` and contains a second
command after a separator — a process-tree signal (auditd, eBPF, Falco, EDR)
that does not depend on application logging.
- Unexpected children of the MCP server process. `nmap` is expected; a shell,
an interpreter or a network client is not.
- MCP tool-call logs where `target` or `additionalFlags` contain shell
metacharacters. A `target` should match an IP, CIDR or hostname and nothing
else.
MITRE ATT&CK [T1059.004 Command and Scripting Interpreter: Unix
Shell](https://attack.mitre.org/techniques/T1059/004/).
## Mitigation
The repository is **archived** and read-only, npm latest is the affected
1.0.1, and no patched release will be published. Removal is the mitigation:
- **Stop using the package.** It is unmaintained, publicly vulnerable since
March 2026, and will not be fixed.
- If it must stay, run it in a container or VM as an unprivileged user, with no
credentials in its environment and no network egress beyond the scan range,
and do not expose it over a network transport.
- Wrap or fork the server to validate `target` against an IP/CIDR/hostname
pattern and to allowlist `additionalFlags` before either reaches the command
string.
**The fix, for anyone forking it**, is to call
`execFile("nmap", [...args])` with an argument vector instead of building a
string for `exec`. Content validation, not just Zod type validation, is the
underlying requirement.
NIST SP 800-53r5 `SI-10`; OWASP ASVS v4 §5.3.8; CWE-78 mitigations M1 and M2.
## Timeline
| Date | Event |
|---|---|
| 2026-03-03 | **CVE-2026-3484 / GHSA-xc68-rrqc-qgq3 published by VulDB** — the original public disclosure, by another reporter |
| 2026-05-29 | Independently identified by source review of the published tarball, unaware of the March advisory |
| 2026-06-01 | Dynamically validated over MCP stdio in an isolated container |
| 2026-06-13 | Duplicate identified during pre-submission deduplication; repository confirmed archived with Private Vulnerability Reporting unavailable. Internal verdict: **do not file** |
| 2026-07-13 | MITRE CNA-LR assigns CVE-2026-52616 regardless, crediting s1ko as discoverer |
| 2026-08-22 | This write-up published, documenting the duplicate |
## References
- **Original advisory** — https://github.com/advisories/GHSA-xc68-rrqc-qgq3
- **Original CVE** — https://nvd.nist.gov/vuln/detail/CVE-2026-3484
- npm package — https://www.npmjs.com/package/mcp-nmap-server
- Repository (archived) — https://github.com/PhialsBasement/nmap-mcp-server
- Precedent for the MCP threat model — CVE-2026-5058 (`aws-mcp-server`)
Companion advisories from the same research pass:
[CVE-2026-52617](https://github.com/s1ko/CVE-2026-52617),
[CVE-2026-52618](https://github.com/s1ko/CVE-2026-52618).
## License
MIT — see [LICENSE](LICENSE).