https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T02:15:56.421854+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-6942 CVE-2026-6942 — radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass 2026-10-07T02:15:56.424046+00:00

Affected: radareorg radare2-mcp

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.