Description

A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protocol can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T19:16:42.910Z",
  "pubdate": "2026-08-17T19:16:42.910Z",
  "executiveSummary": "An unauthenticated remote command injection vulnerability has been identified in kylecui NetForensicMCP version 2.1.0, specifically residing within the execAsync function of the index.js file. The flaw stems from the insecure processing of user-supplied input passed through the interface or protocol arguments, which are subsequently concatenated or passed directly into an underlying operating system shell execution context without adequate sanitization or validation. This security deficiency allows remote attackers to execute arbitrary system commands on the host operating system with the privileges of the running Node.js application process. Successful exploitation of this vulnerability leads to complete system compromise, unauthorized data access, lateral movement within the network, and potential denial of service conditions. The risk is significantly elevated due to the public availability of functional exploit code and the unresponsive nature of the project maintainers to early vulnerability disclosures. Remediation is hindered by the lack of an official patch from the vendor, necessitating immediate manual defensive compensating controls and strict network access restrictions to mitigate potential remote exploitation vectors.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection flaw occurring within the execAsync function implemented inside the index.js file of kylecui NetForensicMCP 2.1.0. The root cause of the vulnerability lies in the unsafe handling of input parameters, specifically the interface and protocol arguments, which are accepted from external requests and directly interpolated into a system shell execution sink without proper input validation, type checking, or argument escaping.\nFrom an attack flow perspective, a remote attacker initiates the exploitation phase by crafting a malicious HTTP or protocol-level request containing specially crafted shell metacharacters, command separators (such as semicolons, pipe symbols, or backticks), and arbitrary system commands injected into the vulnerable interface or protocol parameters. Upon reception, the index.js file processes the incoming payload and forwards it to the execAsync function. Because the function utilizes insecure asynchronous execution wrappers that invoke a standard command shell (such as /bin/sh or cmd.exe), the injected shell commands are executed by the underlying operating system alongside or in place of the intended diagnostic operations.\nThe vulnerable component is explicitly identified as the execAsync function within index.js across all deployments of version 2.1.0. The attack surface is exposed over the network, allowing remote execution without requiring prior authentication or specific user privileges. The payload behavior involves the direct execution of operating system instructions, which can facilitate reverse shells, arbitrary file read and write operations, deployment of malware payloads, and full infrastructure enumeration. Post-exploitation impact includes full system compromise, data exfiltration, and potential persistence mechanisms established on the host running the vulnerable NetForensicMCP instance."
}