CVE-2026-7416 Details

An OS command injection vulnerability has been identified in PolarVista's Xcode MCP Server version 1.0.0. This vulnerability exists in the MCP Interface component, specifically within the build_project and run_tests functions of the src/index.ts file. The issue arises because user-supplied arguments are improperly sanitized before being interpolated into shell command strings. The resulting commands are executed using child_process.exec, allowing an attacker to inject arbitrary operating system commands that execute with the privileges of the server process. This exploitation could lead to a complete compromise of the host, including unauthorized data access, modification of files and application state, and disruption of services.

PolarVista should be contacted to inform them about the vulnerability and request a patch. Once a patch is released, a security advisory should be published.