CVE-2026-5621
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
A vulnerability in ChrisChinchilla Vale-MCP up to version 0.1.0 allows OS command injection via the config_path argument in the HTTP Interface component. Local access is required and the exploit is publicly available.
Risk Assessment
A local attacker can execute arbitrary system commands, potentially leading to full system compromise.
Recommendation
Update Vale-MCP to a patched version or apply a workaround. Restrict local access.
Original NVD description (English source)
A vulnerability was found in ChrisChinchilla Vale-MCP up to 0.1.0. Affected by this vulnerability is an unknown functionality of the file src/index.ts of the component HTTP Interface. The manipulation of the argument config_path results in os command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.