CVE-2026-5802 Details
Description
A vulnerability was identified in idachev mcp-javadc up to 1.2.4. Impacted is an unknown function of the component HTTP Interface. Such manipulation of the argument jarFilePath leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
A command injection vulnerability has been identified in the Idachev MCP-JavaDC tool, specifically in version 1.2.4. The issue resides within the HTTP interface, where the 'jarFilePath' argument of the 'decompile-from-jar' tool can be manipulated to inject operating system commands. This unsanitized input is executed via 'execPromise', allowing arbitrary commands to be run with the privileges of the server process. The vulnerability can be exploited remotely, leading to a full compromise of the host, including unauthorized access to files, modification of system data, and potential disruption of services.
No specific patch or remediation is currently available. However, it is recommended to remove unsanitized input handling from HTTP request processing and replace it with a strict allowlist of commands and argument validation. Adding authentication and rate limiting to sensitive HTTP handlers can also help mitigate the risk.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 8, 2026CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BruceJqs/public_exp/issues/2 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://github.com/idachev/mcp-javadc/ | [email protected] | ProductVendor |
| https://github.com/idachev/mcp-javadc/issues/7 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/786974 | [email protected] | Technical Description |
| https://vuldb.com/vuln/356241 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/356241/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| idachev mcp-javadc | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 8, 2026 | New CVE Received | [email protected] |