CVE-2026-16133

A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manipulation can lead to command injection. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

CVSS v3 5.0 MEDIUM
CVSS v2.0 5.1 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gist.github.com/menelausx/b42381d2788a334cba8cda43f52e2a28
https://github.com/LiuMengxuan04/MiniCode/
https://github.com/LiuMengxuan04/MiniCode/issues/35
https://github.com/LiuMengxuan04/MiniCode/pull/37
https://vuldb.com/cve/CVE-2026-16133
https://vuldb.com/submit/856976
https://vuldb.com/vuln/379853
https://vuldb.com/vuln/379853/cti

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se ha encontrado una falla en LiuMengxuan04 MiniCode 0.1.0. Afectada por esta vulnerabilidad es la función child_process.spawn del archivo mcp.ts. La ejecución de una manipulación puede conducir a una inyección de comandos. El ataque puede lanzarse de forma remota. El ataque requiere un alto nivel de complejidad. La explotación parece ser difícil. El exploit ha sido publicado y puede ser utilizado. La pull request para solucionar este problema espera ser aceptada.

Information

Published : 2026-07-18 19:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-16133

Mitre link : CVE-2026-16133

CVE.ORG link : CVE-2026-16133

JSON object : View

Products Affected

No product.

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2026-16133", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16133", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T17:11:11.911576Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:liumengxuan04:minicode:*:*:*:*:*:*:*:*"], "vendor": "LiuMengxuan04", "product": "MiniCode", "versions": [{"status": "affected", "version": "0.1.0"}]}]}], "published": "2026-07-18T19:17:05.687", "references": [{"url": "https://gist.github.com/menelausx/b42381d2788a334cba8cda43f52e2a28", "source": "cna@vuldb.com"}, {"url": "https://github.com/LiuMengxuan04/MiniCode/", "source": "cna@vuldb.com"}, {"url": "https://github.com/LiuMengxuan04/MiniCode/issues/35", "source": "cna@vuldb.com"}, {"url": "https://github.com/LiuMengxuan04/MiniCode/pull/37", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-16133", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/856976", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/379853", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/379853/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manipulation can lead to command injection. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Se ha encontrado una falla en LiuMengxuan04 MiniCode 0.1.0. Afectada por esta vulnerabilidad es la funci\u00f3n child_process.spawn del archivo mcp.ts. La ejecuci\u00f3n de una manipulaci\u00f3n puede conducir a una inyecci\u00f3n de comandos. El ataque puede lanzarse de forma remota. El ataque requiere un alto nivel de complejidad. La explotaci\u00f3n parece ser dif\u00edcil. El exploit ha sido publicado y puede ser utilizado. La pull request para solucionar este problema espera ser aceptada."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "cna@vuldb.com"}