https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T07:10:25.869241+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07861 bdu:2026-07861 2026-10-18T07:10:25.872168+00:00 bdu:2026-07861 https://cve.radiocsirt.org/vuln/euvd-2026-337049 EUVD-2026-337049 2026-10-18T07:10:25.872200+00:00 EUVD-2026-337049 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6942 fkie_cve-2026-6942 2026-10-18T07:10:25.872214+00:00

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.

 https://cve.radiocsirt.org/vuln/ghsa-g65f-grqm-9jg5 GHSA-g65f-grqm-9jg5 2026-10-18T07:10:25.872242+00:00

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.