CVE-2026-3484
📋 TL;DR
This CVE describes a command injection vulnerability in PhialsBasement's nmap-mcp-server that allows attackers to execute arbitrary commands on the system. The vulnerability exists in the child_process.exec function of the Nmap CLI Command Handler component and can be exploited remotely. Users of this software are affected until they apply the security patch.
💻 Affected Systems
- PhialsBasement nmap-mcp-server
📦 What is this software?
Mcp Nmap Server by Phialsbasement
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands with the privileges of the nmap-mcp-server process, potentially leading to data theft, system takeover, or lateral movement.
Likely Case
Remote code execution allowing attackers to run unauthorized commands, potentially compromising the host system and any connected networks.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, restricting command execution to authorized nmap operations only.
🎯 Exploit Status
Command injection vulnerabilities typically have low exploitation complexity when unauthenticated remote access is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488
Vendor Advisory: https://github.com/PhialsBasement/nmap-mcp-server/commit/30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488
Restart Required: Yes
Instructions:
1. Update to the latest version of nmap-mcp-server. 2. Apply commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. 3. Restart the nmap-mcp-server service.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement strict input validation for all user-supplied parameters passed to the Nmap CLI Command Handler
# Review and sanitize all user inputs in src/index.ts
Network Access Restriction
linuxRestrict network access to the nmap-mcp-server to trusted IP addresses only
# Use firewall rules to limit access: iptables -A INPUT -p tcp --dport [PORT] -s [TRUSTED_IP] -j ACCEPT
# iptables -A INPUT -p tcp --dport [PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable system from critical assets
- Deploy application-level firewalls or WAFs with command injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check if your nmap-mcp-server version is before commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488Check Version:
git log --oneline | head -1Verify Fix Applied:
Verify that commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488 is applied in your installation📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in nmap-mcp-server logs
- Unexpected child process spawns from the nmap service
Network Indicators:
- Unusual outbound connections from the nmap-mcp-server host
- Suspicious command strings in network traffic to the service
SIEM Query:
source="nmap-mcp-server" AND (process_execution="*;*" OR process_execution="*|*" OR process_execution="*`*" OR process_execution="*$(*")🔗 References
- https://github.com/PhialsBasement/nmap-mcp-server/
- https://github.com/PhialsBasement/nmap-mcp-server/commit/30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488
- https://github.com/PhialsBasement/nmap-mcp-server/issues/7
- https://github.com/PhialsBasement/nmap-mcp-server/issues/7#issuecomment-3814382570
- https://vuldb.com/?ctiid.348559
- https://vuldb.com/?id.348559
- https://vuldb.com/?submit.763773
- https://vuldb.com/?submit.763777
