Description

A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-08T11:16:50.040Z",
  "pubdate": "2026-08-08T11:16:50.040Z",
  "executiveSummary": "A command injection vulnerability has been identified in MIMICLab mcp-pdf-vision version 1.1.0, specifically within the load_pdf function located in the src/index.ts file. The vulnerability arises from insecure handling of input parameters, specifically pdfPath and sessionId, which are passed directly to system execution sinks without adequate sanitization or validation.\nSuccessful exploitation of this flaw allows a threat actor to execute arbitrary operating system commands with the privileges of the underlying Node.js process hosting the application. The impact is severe, potentially leading to complete system compromise, unauthorized data access, and execution of malicious payloads on the host environment.\nThis vulnerability is restricted by specific environmental constraints; the attack can only be performed from a local environment, implying that the adversary must already possess local access or leverage a secondary execution vector to reach the vulnerable interface. The project maintainers were notified early via an issue report but have not provided an official response or patch.\nRisk implications remain high for deployments where untrusted local users or auxiliary processes can interact with the vulnerable application logic. Mitigation requires strict input sanitization, the avoidance of shell-based execution primitives, and adherence to secure coding practices when interfacing with operating system processes.",
  "technicalDetails": "The vulnerability resides in the src/index.ts file of MIMICLab mcp-pdf-vision 1.1.0, specifically inside the load_pdf function. The root cause of the vulnerability is the unsafe interpolation or concatenation of untrusted input arguments—specifically pdfPath and sessionId—into commands executed by the underlying operating system shell via child process spawning functions.\nAttack flow begins when an attacker supplies a crafted string containing shell metacharacters, command separators (such as semicolons, ampersands, or pipe symbols), or backticks within the pdfPath or sessionId parameters. When the load_pdf function processes these inputs, the lack of robust input validation or parameterization causes the shell to interpret the injected characters as instruction delimiters.\nConsequently, the operating system executes the attacker-supplied payload alongside or instead of the intended utility execution. Because the application interacts directly with system-level commands to parse or render PDF assets, the injected payload inherits the execution context and permission level of the process running the Node.js application.\nRegarding exposure and prerequisites, the attack requires local access to the environment where the application is executed. Authentication and privilege requirements depend on the host operating system controls and the specific user account running the mcp-pdf-vision instance. No network exposure is inherently required if the interface is bound exclusively to local execution paths, limiting the attack surface to local threat actors or chained vulnerabilities.\nPost-exploitation impact includes arbitrary command execution on the host system, enabling the adversary to read sensitive files, exfiltrate data, pivot to other local resources, or establish persistent unauthorized access depending on system hardening configurations."
}