CVE-2026-75011
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
NetForensicMCP 2.1.0 has a vulnerability in the execAsync function of index.js, where manipulation of the interface/protocol argument can lead to command injection. The attack can be launched remotely, and the exploit has been published.
Risk Assessment
The risk includes remote execution of arbitrary commands on the server, potentially leading to full system compromise.
Recommendation
It is recommended to immediately stop using the vulnerable version and apply available patches or workarounds if any.
Original NVD description (English source)
A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protocol can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.