Nor2-io heim-mcp up to 0.1.3 new_heim_application src/tools.ts registerTools os command injection

Summaryinfo

A vulnerability was found in Nor2-io heim-mcp up to 0.1.3 and classified as critical. The affected element is the function registerTools of the file src/tools.ts of the component new_heim_application/deploy_heim_application/deploy_heim_application_to_cloud. Such manipulation leads to os command injection. This vulnerability is traded as CVE-2026-5602. An attack has to be approached locally. Furthermore, there is an exploit available. A patch should be applied to remediate this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Nor2-io heim-mcp up to 0.1.3. Affected by this issue is the function registerTools of the file src/tools.ts of the component new_heim_application/deploy_heim_application/deploy_heim_application_to_cloud. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-5602. The exploitation is known to be easy. Local access is required to approach this attack. Technical details as well as a public exploit are known. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

The exploit is available at github.com. It is declared as proof-of-concept. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Applying the patch c321d8af25f77668781e6ccb43a1336f9185df37 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• Nor2-io

Name

• heim-mcp

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3

License

• open-source

Website

• Product: https://github.com/Nor2-io/heim-mcp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #784862: Nor2-io heim-mcp <=0.1.3 Command Injection (by Yinci Chen)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion