AI agent vulnerability · Other MCP servers and tools

CVE-2026-7600: yii2-mcp-server has a Command Injection Issue

lowCVSS 4.0 2.1 · 3.1 6.3GHSA-gc8w-x73w-p4rh

A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yiicommandhelp/yiiexecutecommand of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Published May 2, 2026 · Updated May 7, 2026

Affected packages

yii2-mcp-server

Ecosystem: npm
Affected: <= 1.0.2
Fixed in: No patched version yet
Check: npm ls yii2-mcp-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries