CVE-2026-7629

kleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injection

CVSS 5.3 MEDIUMEPSS 1.1%CWE-74 CWE-77

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 5.3EPSS 1.1%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

02 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A flaw has been found in kleneway awesome-cursor-mpc-server up to 2.0.1. Impacted is the function runCodeReviewTool of the file src/tools/codeReview.ts of the component Ccode-Review Tool. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

kleneway · awesome-cursor-mpc-server

public PoCs found — 1

cve_referencegithub.com/user-attachments/files/26019723/awesome-cursor-mpc-server_bug.pdfunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/kleneway/awesome-cursor-mpc-server/https://github.com/kleneway/awesome-cursor-mpc-server/issues/6 https://github.com/kleneway/awesome-cursor-mpc-server/pull/14 https://github.com/user-attachments/files/26019723/awesome-cursor-mpc-server_bug.pdf https://vuldb.com/submit/806470 https://vuldb.com/vuln/360575 https://vuldb.com/vuln/360575/cti