CVE-2026-6942— radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6942
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Radare2 MCP Server 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Radare2 MCP Server是radare org开源的一款基于radare2的二进制分析工具。 Radare2 MCP Server 1.6.0及之前版本存在操作系统命令注入漏洞，该漏洞源于操作系统命令注入，允许远程攻击者通过用户控制输入中的shell元字符绕过命令过滤器执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2026-6942
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6942
请登录查看更多情报信息。
Same Patch Batch · radareorg · 2026-04-23 · 3 CVEs total
| CVE-2026-6940 | 7.1 HIGH | radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion |
| CVE-2026-6941 | 6.6 MEDIUM | radare2 < 6.1.4 Project Notes Path Traversal via Symlink |
IV. Related Vulnerabilities
Same product: radare2
- CVE-2026-6941
radare2 < 6.1.4 Project Notes Path Traversal via Symlink - CVE-2026-6940
radare2 < 6.1.4 Project Deletion Path Traversal Directory De - CVE-2026-40517
radare2 < 6.1.4 Command Injection via PDB Parser Symbol Name - CVE-2026-40527
radare2 Command Injection via DWARF Parameter Names - CVE-2026-41015
Radare2 安全漏洞
Same vendor: radareorg
- CVE-2026-6941
radare2 < 6.1.4 Project Notes Path Traversal via Symlink - CVE-2026-6940
radare2 < 6.1.4 Project Deletion Path Traversal Directory De - CVE-2026-40517
radare2 < 6.1.4 Command Injection via PDB Parser Symbol Name - CVE-2026-40527
radare2 Command Injection via DWARF Parameter Names - CVE-2026-40499
radare2 < 6.1.4 Command Injection via PDB Parser print_gvars
Same weakness: CWE-78
- CVE-2026-8273
D-Link DNS-320 system_mgr.cgi cgi_merge_user os command inje - CVE-2026-8272
D-Link DNS-320 webfile_mgr.cgi chown os command injection - CVE-2026-8271
D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command inje - CVE-2026-8265
Tenda AC6 httpd getLogFile get_log_file os command injection - CVE-2026-8264
Tenda AC6 httpd WifiApScan formWifiApScan os command injecti
V. Comments for CVE-2026-6942
No comments yet