CVE-2026-6942: radare radare2_mcp_server OS Command Injection

Vulnerability summary

CVE-2026-6942 is a critical (CVSS 9.8) OS Command Injection vulnerability in radare radare2_mcp_server. EPSS estimates a 2.98% chance of exploitation in the next 30 days, higher than 87.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-04-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.