CVE-2026-7629 Details
Description
A flaw has been found in kleneway awesome-cursor-mpc-server up to 2.0.1. Impacted is the function runCodeReviewTool of the file src/tools/codeReview.ts of the component Ccode-Review Tool. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
A command injection vulnerability has been identified in Kleneway Awesome-Cursor-MPC-Server versions through 2.0.1. The issue arises in the Code Review Tool, specifically within the runCodeReviewTool function in src/tools/codeReview.ts. The vulnerability allows for remote exploitation by manipulating the folderPath parameter, which is directly concatenated into shell commands and executed using the execSync() function. This unsanitized input can be replaced with shell meta-characters to alter the command execution behavior.
Users are advised to update to the latest version of Kleneway Awesome-Cursor-MPC-Server, where this vulnerability has been fixed. For those unable to update, a temporary workaround is to manually sanitize the folderPath input before it is used in the runCodeReviewTool function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 2, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kleneway/awesome-cursor-mpc-server/issues/6 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/kleneway/awesome-cursor-mpc-server/ | [email protected] | Vendor |
| https://github.com/kleneway/awesome-cursor-mpc-server/issues/6 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/kleneway/awesome-cursor-mpc-server/pull/14 | [email protected] | Issue TrackingVendor |
| https://github.com/user-attachments/files/26019723/awesome-cursor-mpc-server_bug.pdf | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/submit/806470 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360575 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360575/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kleneway awesome-cursor-mpc-server | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | CVE Modified | CISA-ADP |
| May 2, 2026 | New CVE Received | [email protected] |