CVE-2026-7785 Details
Description
A security flaw has been discovered in A-G-U-P-T-A wireshark-mcp edaf604416fbc94a201b4043092d4a1b09a12275/400c3da70074f22f3cce7ccb65304cafc7089c89. This affects the function quick_capture of the file pyshark_mcp.py. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
A command injection vulnerability has been identified in A-G-U-P-T-A's Wireshark-MCP project, specifically within the 'quick_capture' function of the 'pyshark_mcp.py' file. This vulnerability allows for arbitrary operating system command execution by manipulating the 'interface' parameter. The issue arises because the function interpolates user-controlled input into a shell command without proper sanitization, enabling crafted payloads to escape the intended context and execute commands on the server. The vulnerability can be exploited remotely, and the proof of concept has been made public.
The recommended fix is to remove 'shell=True' from the 'quick_capture' function, build the command as an argument list, and execute it with 'shell=False'. Additionally, validate the 'interface' input against a whitelist of system interfaces and add regression tests to ensure that shell metacharacter payloads are properly handled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 5, 2026CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/A-G-U-P-T-A/wireshark-mcp/ | [email protected] | Source CodeVendor |
| https://github.com/A-G-U-P-T-A/wireshark-mcp/issues/1 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/submit/807745 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360985 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/360985/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| A-G-U-P-T-A wireshark-mcp | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 5, 2026 | New CVE Received | [email protected] |