Most recent entries from all

EUVD-2026-318027

fkie_cve-2026-43901

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox (_allowed_dirs) is None by default and only activates when the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.

GHSA-3r68-x3xc-rxpg — wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured

Affected: PyPI: wireshark-mcp

## Description

### Impact

`wireshark-mcp` exposes a `wireshark_export_objects` MCP tool that accepts an attacker-controlled `dest_dir` parameter and passes it to tshark's `--export-objects` flag with **no mandatory path restriction**.

The path sandbox (`_allowed_dirs`) is `None` by default and only activates when the environment variable `WIRESHARK_MCP_ALLOWED_DIRS` is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.

**Affected code** (`src/wireshark_mcp/tshark/client.py:531-543`):

```python

output_validation = self._validate_output_path(dest_dir)

# _validate_output_path only enforces the sandbox when _allowed_dirs is set.

# Default: _allowed_dirs = None → no restriction.

os.makedirs(dest_dir, exist_ok=True) # creates arbitrary directories

cmd = [..., "--export-objects", f"{protocol},{dest_dir}"]

```

### Attack Scenario

An attacker embeds a crafted HTTP response in a pcap file (e.g. `Content-Disposition: filename=authorized_keys`). Via prompt injection in the pcap payload, an AI model using this MCP server is manipulated into calling `wireshark_export_objects` with:

```bash

dest_dir=/home/user/.ssh/

```

`tshark` then extracts and writes the HTTP object to that path, granting the attacker SSH access.

The same technique can target:

- `/etc/cron.d/`

- Writable web roots

- Other sensitive filesystem locations

### Additional Affected Operations

The same missing sandbox affects:

- `merge_pca…

PYSEC-2026-3426 — wireshark-mcp vulnerable to arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured