CVE-2026-6942 - Vulnerability Analysis

Overview

radare2-mcp <= 1.6.0 contains a command injection caused by improper filtering of shell metacharacters in user input passed to r2_cmd_str(), letting remote attackers execute arbitrary commands via the jsonrpc interface without authentication.

Severity & Score

Impact

Remote attackers can execute arbitrary commands on the host, potentially leading to full system compromise.

Mitigation

Update to a version later than 1.6.0 or the latest available version.

References

• https://github.com/radareorg/radare2-mcp/commit/482cde6500009112a8bc0b3fa8d2ef6180581ec0
• https://github.com/radareorg/radare2-mcp/issues/45
• https://www.vulncheck.com/advisories/radare2-mcp-os-command-injection-via-shell-metacharacter-bypass

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner