Description
A security vulnerability has been detected in MoussaabBadla code-screenshot-mcp up to 0.1.0. This affects an unknown part of the component HTTP Interface. Such manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-04-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote OS command execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in MoussaabBadla’s code-screenshot-mcp HTTP interface allows an attacker to inject operating‑system commands via crafted requests, giving the attacker the ability to run arbitrary commands on the host. This results in a compromise of confidentiality, integrity, and availability, as the attacker can execute any shell command with the privileges of the running service.

Affected Systems

The vulnerability affects all releases of MoussaabBadla code-screenshot-mcp up to and including version 0.1.0. The precise component within the HTTP interface that is impacted is not specified, but any instance of the application exposed to untrusted traffic is potentially vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity, but the public disclosure of an exploit and the lack of a vendor response increase the risk. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the vulnerable interface remotely via HTTP, making the vector network‑based. Without a patch, the risk remains high, and the attack remains feasible as demonstrated by publicly available proof‑of‑concept code.

Generated by OpenCVE AI on April 5, 2026 at 02:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for an updated release of code-screenshot-mcp that contains a fix and upgrade if available.
  • If no fix exists, block access to the vulnerable HTTP endpoint from all but trusted networks using firewall or routing rules.
  • Deploy a web application firewall or input validation layer to detect and block malformed command injection payloads.
  • Enable detailed logs on the HTTP interface and monitor for suspicious or unexpected command execution activity.

Generated by OpenCVE AI on April 5, 2026 at 02:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Moussaabbadla
Moussaabbadla code-screenshot-mcp
Vendors & Products Moussaabbadla
Moussaabbadla code-screenshot-mcp

Mon, 06 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in MoussaabBadla code-screenshot-mcp up to 0.1.0. This affects an unknown part of the component HTTP Interface. Such manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title MoussaabBadla code-screenshot-mcp HTTP os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Moussaabbadla Code-screenshot-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T16:39:10.209Z

Reserved: 2026-04-04T06:24:19.838Z

Link: CVE-2026-5528

cve-icon Vulnrichment

Updated: 2026-04-06T16:39:06.807Z

cve-icon NVD

Status : Deferred

Published: 2026-04-05T00:16:04.157

Modified: 2026-04-24T18:13:28.877

Link: CVE-2026-5528

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:57:27Z

Weaknesses