PT-2026-32188

CVE-2026-6130

Published

2026-04-12

Updated

2026-04-13

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions chatboxai chatbox versions up to 1.20.0

Description A flaw exists in the StdioClientTransport function within the src/main/mcp/ipc-stdio-transport.ts file of the Model Context Protocol Server Management System component. Manipulation of the args/env argument can lead to os command injection. The attack can be launched remotely. The exploit has been published.

Recommendations Update to a version beyond 1.20.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Yu_Bao

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')