Submit #747209: GitHub HarmonyOS-mcp-server v0.1.0 Command Injectioninfo

TitleGitHub HarmonyOS-mcp-server v0.1.0 Command Injection
DescriptionThe `text` parameter of the `input_text` tool provided by MCP uses the `asyncio.create_subprocess_shell` function for parse. This leads to arbitrary code execution. # TimeLine January 16, 2026: Vulnerability discovered January 19, 2026: Author XixianLiang notified January 24, 2026: Author confirms the vulnerability exists
Source⚠️ https://github.com/scanleale/MCP_sec/blob/main/HarmonyOS-mcp-server%20RCE%20vulnerability.md
User
 Lexpl0it (UID 89340)
Submission01/27/2026 07:03 (6 months ago)
Moderation02/06/2026 21:52 (11 days later)
StatusAccepted
VulDB entry344766 [XixianLiang HarmonyOS-mcp-server 0.1.0 input_text os command injection]
Points19

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!