CVE-2026-2178

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2178
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2178.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2178
Aliases
Published
2026-02-08T19:02:12Z
Modified
2026-10-21T02:56:21Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
r-huijts xcode-mcp-server run_lldb index.ts registerXcodeTools command injection
Details

A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb. This affects the function registerXcodeTools of the file src/tools/xcode/index.ts of the component run_lldb. The manipulation of the argument args results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as 11f8d6bacadd153beee649f92a78a9dad761f56f. Applying a patch is advised to resolve this issue.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-77"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2178.json"
}
References

Affected packages

Git / github.com/r-huijts/xcode-mcp-server

Affected ranges

Type
GIT
Repo
https://github.com/r-huijts/xcode-mcp-server
Events
Introduced
f3419f00117aa9949e326f78cc940166c88f18cb
Fixed
11f8d6bacadd153beee649f92a78a9dad761f56f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "f3419f00117aa9949e326f78cc940166c88f18cb"
                },
                {
                    "last_affected":  "f3419f00117aa9949e326f78cc940166c88f18cb"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "11f8d6bacadd153beee649f92a78a9dad761f56f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
f3419f00117aa9949e326f78cc940166c88f18cb

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2178.json"