CVE-2026-7443

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7443
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7443.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7443
Published
2026-04-29T22:45:12.342Z
Modified
2026-07-15T01:49:14.332922985Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection
Details

A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this vulnerability is the function fuzz_domain of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument Request can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7443.json",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0"
                },
                {
                    "last_affected": "1.0.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/w0h1v/mcp-dnstwist

Affected ranges

Type
GIT
Repo
https://github.com/w0h1v/mcp-dnstwist
Events
Introduced
64fe6d225b9d6930f30e6f1169e528619b671550
Last affected
af62d09328f762a3581cd354997299ed0a758c11
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.0.1"
        },
        {
            "last_affected": "1.0.1"
        },
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2"
        },
        {
            "introduced": "1.0.3"
        },
        {
            "last_affected": "1.0.3"
        },
        {
            "introduced": "1.0.4"
        },
        {
            "last_affected": "1.0.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.1
1.0.2
1.0.3
1.0.4
v1.*
v1.0.1
v1.0.2
v1.0.3
v1.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7443.json"