CVE-2026-7593

A security vulnerability has been detected in Sunwood-ai-labs command-executor-mcp-server up to 0.1.0. This impacts the function execute_command of the file src/index.ts of the component MCP Interface. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-77
• CWE-78

• https://github.com/Sunwood-ai-labs/command-executor-mcp-server/
• https://github.com/Sunwood-ai-labs/command-executor-mcp-server/issues/6
• https://vuldb.com/submit/805507
• https://vuldb.com/vuln/360546
• https://vuldb.com/vuln/360546/cti

Published

May 1, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75922Reverse::Proxy versions before 0.04 for Perl allow HTTP requ…5.3
• CVE-2026-75924A flaw was found in managed-serviceaccount. A compromised ad…8.7
• CVE-2026-75925Improper neutralization of CRLF sequences in IXON VPN Client…9.6
• CVE-2026-75926Hugo 0.161.0 placed the Node asset pipelines behind the Node…8.6
• CVE-2026-75927The PublishPress Capabilities – User Role Editor, Access Per…7.2
• CVE-2026-75928The Brushfire platform's video content streaming application…5.3
• CVE-2026-75930The FundEngine – Donation and Crowdfunding Platform plugin f…4.3
• CVE-2026-75931fast-uri is a URI parser for Node.js. It canonicalizes a hos…7.5
• CVE-2026-75932Jet Admin allows an attacker to create a malicious app and c…8.6
• CVE-2026-75933Jet Admin allows an authenticated attacker to inject JavaScr…7.3
• CVE-2026-75935Uncontrolled memory allocation in the binary Ion stream curs…7.5
• CVE-2026-75936Improper handling of highly compressed data in the GZIP auto…7.5