CVE-2026-2131

2.1 lowEPSS 17%

A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function input_text. The manipulation of the argument text leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 17% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-77
Published: 2026-02-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xixianliang:harmonyos_mcp_server

References

https://github.com/scanleale/MCP_sec/blob/main/HarmonyOS-mcp-server%20RCE%20vulnerability.md
https://vuldb.com/?ctiid.344766
https://vuldb.com/?id.344766
https://vuldb.com/?submit.747209

Check your stack JSON