CVE-2026-7446

The record

A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directory/create_rule of the file src/index.ts of the component MCP Interface. The manipulation of the argument ID results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.1 is able to mitigate this issue. The patch is identified as 141335da044e53c3f5b315e0386e01238405b771. It is advisable to upgrade the affected component.

Affected packages

Related vulnerabilities

• GHSA-86hp-qxqp-w9wv mcp-server-semgrep has a Command Injection issue Same vulnerability
• CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-77
• CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-77
• CVE-2026-55453 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-77
• CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-77
• CVE-2026-102826 simple-git, an interface for running git commands in any node.js application, enables… CWE-77
• CVE-2026-79945 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-77
• CVE-2026-79741 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-77