Search
Find a vulnerability
Search criteria
4 vulnerabilities by PhialsBasement
CVE-2026-19373 (GCVE-0-2026-19373)
Vulnerability from nvd – Published: 2026-08-09 22:45 – Updated: 2026-08-11 01:51
VLAI
EPSS
VEX
Title
PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery
Summary
A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 01:50 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387257 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387257/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19373 | third-party-advisory |
| https://vuldb.com/submit/866271 | third-party-advisory |
| https://github.com/PhialsBasement/KoboldCPP-MCP-S… | issue-tracking |
| https://github.com/PhialsBasement/KoboldCPP-MCP-Server/ | product |
| https://github.com/adenot/mcp-google-search/issues/11 | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PhialsBasement | KoboldCPP-MCP-Server |
Affected:
1.0.0
cpe:2.3:a:phialsbasement:koboldcpp-mcp-server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19373",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T01:50:53.748748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T01:51:11.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/adenot/mcp-google-search/issues/11"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:phialsbasement:koboldcpp-mcp-server:*:*:*:*:*:*:*:*"
],
"modules": [
"BaseConfigSchema"
],
"product": "KoboldCPP-MCP-Server",
"vendor": "PhialsBasement",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gongyanyu05 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T22:45:13.091Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387257 | PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387257"
},
{
"name": "VDB-387257 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387257/cti"
},
{
"name": "CVE-2026-19373 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19373"
},
{
"name": "Submit #866271 | PhialsBasement KoboldCPP-MCP-Server 1.0.0 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/866271"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/PhialsBasement/KoboldCPP-MCP-Server/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-09T09:31:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19373",
"datePublished": "2026-08-09T22:45:13.091Z",
"dateReserved": "2026-08-09T07:25:15.620Z",
"dateUpdated": "2026-08-11T01:51:11.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3484 (GCVE-0-2026-3484)
Vulnerability from nvd – Published: 2026-03-03 19:32 – Updated: 2026-03-04 21:10 X_Open Source
VLAI
EPSS
VEX
Title
PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injection
Summary
A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_process.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. It is best practice to apply a patch to resolve this issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-04 21:10 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.348559 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.348559 | signaturepermissions-required |
| https://vuldb.com/?submit.763773 | third-party-advisory |
| https://vuldb.com/?submit.763777 | third-party-advisory |
| https://github.com/PhialsBasement/nmap-mcp-server… | issue-tracking |
| https://github.com/PhialsBasement/nmap-mcp-server… | issue-tracking |
| https://github.com/PhialsBasement/nmap-mcp-server… | patch |
| https://github.com/PhialsBasement/nmap-mcp-server/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PhialsBasement | nmap-mcp-server |
Affected:
bee6d23547d57ae02460022f7c78ac0893092e38
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3484",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-04T21:10:24.618814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T21:10:37.485Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Nmap CLI Command Handler"
],
"product": "nmap-mcp-server",
"vendor": "PhialsBasement",
"versions": [
{
"status": "affected",
"version": "bee6d23547d57ae02460022f7c78ac0893092e38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yinci Chen (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_process.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. It is best practice to apply a patch to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-03T19:32:09.297Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-348559 | PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.348559"
},
{
"name": "VDB-348559 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.348559"
},
{
"name": "Submit #763773 | PhialsBasement nmap-mcp-server \u003c=1.0.1 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.763773"
},
{
"name": "Submit #763777 | PhialsBasement nmap-mcp-server \u003c=1.0.1 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.763777"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/PhialsBasement/nmap-mcp-server/issues/7"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/PhialsBasement/nmap-mcp-server/issues/7#issuecomment-3814382570"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PhialsBasement/nmap-mcp-server/commit/30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488"
},
{
"tags": [
"product"
],
"url": "https://github.com/PhialsBasement/nmap-mcp-server/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-03-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-03T16:22:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-3484",
"datePublished": "2026-03-03T19:32:09.297Z",
"dateReserved": "2026-03-03T15:16:15.700Z",
"dateUpdated": "2026-03-04T21:10:37.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19373 (GCVE-0-2026-19373)
Vulnerability from cvelistv5 – Published: 2026-08-09 22:45 – Updated: 2026-08-11 01:51
VLAI
EPSS
VEX
Title
PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery
Summary
A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 01:50 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387257 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387257/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19373 | third-party-advisory |
| https://vuldb.com/submit/866271 | third-party-advisory |
| https://github.com/PhialsBasement/KoboldCPP-MCP-S… | issue-tracking |
| https://github.com/PhialsBasement/KoboldCPP-MCP-Server/ | product |
| https://github.com/adenot/mcp-google-search/issues/11 | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PhialsBasement | KoboldCPP-MCP-Server |
Affected:
1.0.0
cpe:2.3:a:phialsbasement:koboldcpp-mcp-server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19373",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T01:50:53.748748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T01:51:11.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/adenot/mcp-google-search/issues/11"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:phialsbasement:koboldcpp-mcp-server:*:*:*:*:*:*:*:*"
],
"modules": [
"BaseConfigSchema"
],
"product": "KoboldCPP-MCP-Server",
"vendor": "PhialsBasement",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "gongyanyu05 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-09T22:45:13.091Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387257 | PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387257"
},
{
"name": "VDB-387257 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387257/cti"
},
{
"name": "CVE-2026-19373 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19373"
},
{
"name": "Submit #866271 | PhialsBasement KoboldCPP-MCP-Server 1.0.0 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/866271"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/PhialsBasement/KoboldCPP-MCP-Server/issues/3"
},
{
"tags": [
"product"
],
"url": "https://github.com/PhialsBasement/KoboldCPP-MCP-Server/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-09T09:31:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19373",
"datePublished": "2026-08-09T22:45:13.091Z",
"dateReserved": "2026-08-09T07:25:15.620Z",
"dateUpdated": "2026-08-11T01:51:11.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3484 (GCVE-0-2026-3484)
Vulnerability from cvelistv5 – Published: 2026-03-03 19:32 – Updated: 2026-03-04 21:10 X_Open Source
VLAI
EPSS
VEX
Title
PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injection
Summary
A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_process.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. It is best practice to apply a patch to resolve this issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-04 21:10 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.348559 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.348559 | signaturepermissions-required |
| https://vuldb.com/?submit.763773 | third-party-advisory |
| https://vuldb.com/?submit.763777 | third-party-advisory |
| https://github.com/PhialsBasement/nmap-mcp-server… | issue-tracking |
| https://github.com/PhialsBasement/nmap-mcp-server… | issue-tracking |
| https://github.com/PhialsBasement/nmap-mcp-server… | patch |
| https://github.com/PhialsBasement/nmap-mcp-server/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PhialsBasement | nmap-mcp-server |
Affected:
bee6d23547d57ae02460022f7c78ac0893092e38
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3484",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-04T21:10:24.618814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-04T21:10:37.485Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Nmap CLI Command Handler"
],
"product": "nmap-mcp-server",
"vendor": "PhialsBasement",
"versions": [
{
"status": "affected",
"version": "bee6d23547d57ae02460022f7c78ac0893092e38"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yinci Chen (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_process.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. It is best practice to apply a patch to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-03T19:32:09.297Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-348559 | PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.348559"
},
{
"name": "VDB-348559 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.348559"
},
{
"name": "Submit #763773 | PhialsBasement nmap-mcp-server \u003c=1.0.1 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.763773"
},
{
"name": "Submit #763777 | PhialsBasement nmap-mcp-server \u003c=1.0.1 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.763777"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/PhialsBasement/nmap-mcp-server/issues/7"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/PhialsBasement/nmap-mcp-server/issues/7#issuecomment-3814382570"
},
{
"tags": [
"patch"
],
"url": "https://github.com/PhialsBasement/nmap-mcp-server/commit/30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488"
},
{
"tags": [
"product"
],
"url": "https://github.com/PhialsBasement/nmap-mcp-server/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-03-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-03T16:22:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "PhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-3484",
"datePublished": "2026-03-03T19:32:09.297Z",
"dateReserved": "2026-03-03T15:16:15.700Z",
"dateUpdated": "2026-03-04T21:10:37.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}