CVE-2026-5621
MEDIUMChrisChinchilla Vale-MCP HTTP index.ts os command injection
Title source: cnaDescription
A vulnerability was found in ChrisChinchilla Vale-MCP up to 0.1.0. Affected by this vulnerability is an unknown functionality of the file src/index.ts of the component HTTP Interface. The manipulation of the argument config_path results in os command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
References (4)
Core 4
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-355411 | ChrisChinchilla Vale-MCP HTTP index.ts os command injection
https://vuldb.com/vuln/355411
Signature, Permissions Required signature
permissions-required
VDB-355411 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/355411/cti
Third Party Advisory third-party-advisory
Submit #785591 | ChrisChinchilla Vale-MCP 0.1.0 Command Injection
https://vuldb.com/submit/785591
Exploit exploit
issue-tracking
https://github.com/wing3e/public_exp/issues/27
Scores
CVSS v3
5.3
EPSS
0.0069
EPSS Percentile
48.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-77
CWE-78
Status
published
Products (1)
ChrisChinchilla/Vale-MCP
0.1.0
Published
Apr 06, 2026
Tracked Since
Apr 06, 2026