AI agent vulnerability · Other MCP servers and tools

CVE-2026-7446: mcp-server-semgrep has a Command Injection issue

mediumCVSS 4.0 5.5 · 3.1 7.3GHSA-86hp-qxqp-w9wv

A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyzeresults/filterresults/exportresults/compareresults/scandirectory/createrule of the file src/index.ts of the component MCP Interface. The manipulation of the argument ID results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

Published Apr 30, 2026 · Updated May 6, 2026

Affected packages

mcp-server-semgrep

Ecosystem: npm
Affected: <= 1.0.0
Fixed in: 1.0.1
Check: npm ls mcp-server-semgrep

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directory/create_rule of the file src/index.ts of the component MCP Interface. The manipulation of the argument ID results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.1 is able to mitigate this issue. The patch is identified as 141335da044e53c3f5b315e0386e01238405b771. It is advisable to upgrade the affected component.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries