PT-2026-7010

CVE-2026-2178

Published

2026-02-08

Updated

2026-03-05

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions r-huijts xcode-mcp-server versions up to f3419f00117aa9949e326f78cc940166c88f18cb

Description A command injection issue exists in the registerXcodeTools function within the src/tools/xcode/index.ts file of the run lldb component. Manipulation of the args argument can lead to remote command execution. The exploit has been publicly released.

Recommendations Apply the patch identified as 11f8d6bacadd153beee649f92a78a9dad761f56f to resolve this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Lexpl0It

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')