CVE-2026-79538 in MetaMCP
Summary
by MITRE • 09/29/2026
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO branch, routers/mcp-proxy/server.ts).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in metatool-ai MetaMCP versions up to and including 2.4.22 represents a critical server-side code execution flaw located within the internal Model Context Protocol inspector proxy endpoint. Specifically, this issue resides in the GET /mcp-proxy/server/stdio route handler, which is responsible for establishing transport connections via the STDIO branch of the createTransport function found in routers/mcp-proxy/server.ts. This component acts as a bridge between external requests and local standard input/output streams, facilitating communication with backend services or tools that rely on process-based interactions. The architectural design assumes that inputs processed through this proxy are sanitized and validated before being passed to underlying system commands or interpreters, an assumption that proves incorrect in the affected versions due to insufficient validation of user-supplied data.
The technical root cause of this vulnerability is a classic command injection flaw resulting from improper neutralization of special elements used in operating system commands. When a request is made to the specified endpoint, the application constructs a shell command or invokes an interpreter using parameters derived directly from the HTTP request without adequate sanitization. An attacker can exploit this by injecting malicious payloads into query parameters or headers that are subsequently concatenated into the execution string. Because the proxy operates with the privileges of the user running the MetaMCP service, successful exploitation allows for arbitrary code execution on the host system. This is not merely a data leakage issue but a full compromise vector where an attacker can execute shell commands, install malware, pivot to other systems within the network, or exfiltrate sensitive data stored in the environment variables or file system accessible to that user context.
From an operational impact perspective, this vulnerability poses a severe risk to the integrity and availability of the hosting infrastructure. Since MetaMCP is often used in development environments where it may have elevated permissions for testing purposes, the blast radius of exploitation can be extensive. An attacker gaining code execution could potentially access API keys, database credentials, or source code repositories stored on the machine. Furthermore, because this endpoint is part of an inspector proxy intended for debugging and monitoring, it might be exposed to internal networks with less rigorous security controls than production-facing APIs, increasing the likelihood of successful exploitation by insider threats or compromised internal hosts. The ability to execute arbitrary commands effectively bypasses application-level access controls, rendering any authentication mechanisms surrounding the broader MetaMCP interface irrelevant if this specific endpoint is reachable.
This vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-94 Code Injection. In terms of offensive security frameworks, it maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically the sub-technique for shell commands such as sh or bash depending on the underlying operating system. The exploitation path also reflects aspects of T1203 Exploitation for Client Execution if the proxy is triggered via a malicious client interaction that leads to server-side processing. Understanding these mappings helps in categorizing the risk correctly within vulnerability management programs and ensures that remediation efforts address both the immediate code flaw and the broader architectural assumptions regarding trust boundaries between external inputs and internal system processes.
Mitigation strategies must prioritize immediate patching of MetaMCP to version 2.4.23 or later, where this input validation issue has been addressed by developers implementing strict allow-lists for command arguments and utilizing safe API calls that do not invoke shell interpreters directly. In the interim, if upgrading is not immediately feasible, network-level controls should be implemented to restrict access to the /mcp-proxy/server/stdio endpoint exclusively from trusted internal IP addresses or localhost connections. Additionally, running MetaMCP with least-privilege principles is essential; the service should operate under a dedicated user account with minimal permissions, preventing an attacker from leveraging executed commands for broader system compromise. Input validation at the application layer must be enforced to ensure that any data passed through the proxy does not contain shell metacharacters such as semicolons, pipes, or backticks unless explicitly required and safely escaped by robust sanitization libraries rather than ad-hoc string manipulation.