CVE-2026-5528
MoussaabBadla code-screenshot-mcp HTTP os command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Apr 4, 2026
- Updated
- Apr 6, 2026
- Reserved
- Apr 4, 2026
Description
A security vulnerability has been detected in MoussaabBadla code-screenshot-mcp up to 0.1.0. This affects an unknown part of the component HTTP Interface. Such manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
code-screenshot-mcpMoussaabBadla |
|
References
- VDB-355281 | MoussaabBadla code-screenshot-mcp HTTP os command injectionvdb-entry
- VDB-355281 | CTI Indicators (IOB, IOC, TTP)signaturepermissions-required
- Submit #782064 | MoussaabBadla code-screenshot-mcp 0.1.0 Command Injectionthird-party-advisory
- https://github.com/wing3e/public_exp/issues/23exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.