CVE-2026-2131

MEDIUM

XixianLiang HarmonyOS-mcp-server <0.1.0 - Command Injection

Title source: llm

Description

A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function input_text. The manipulation of the argument text leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

References (4)

Core 4

Core References

Permissions Required, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.344766

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.344766

Permissions Required, VDB Entry third-party-advisory

https://vuldb.com/?submit.747209

Various Sources exploit

https://github.com/scanleale/MCP_sec/blob/main/HarmonyOS-mcp-server%20RCE%20vulnerability.md

View Writeup ZIP pw:eip

Scores

CVSS v3 6.3

EPSS 0.1505

EPSS Percentile 96.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-77 CWE-78

Status published

Products (1)

xixianliang/harmonyos_mcp_server 0.1.0

Published Feb 08, 2026

Tracked Since Feb 18, 2026