Command Injection in PolarVista xcode-mcp-server

Executive Summary

CVE-2026-7416 is a critical OS command injection vulnerability found in the PolarVista xcode-mcp-server project, specifically in the build_project and run_tests tools. These tools unsafely incorporate user-supplied arguments such as projectPath, scheme, configuration, and destination directly into shell command strings without proper sanitization or neutralization of shell metacharacters.

Because of this unsafe handling, an attacker with network access to the MCP interface can inject arbitrary operating system commands that execute with the privileges of the server process. This means the attacker can run any command on the host system, potentially taking full control.

The vulnerability arises from the use of Node.js's child_process.exec function with user-controlled input, allowing shell metacharacters to be interpreted and executed. No authentication or sandboxing is effectively in place, making exploitation easier.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the command injection in the vulnerable tools `build_project` and `run_tests` of the xcode-mcp-server. Since the vulnerability arises from unsafe interpolation of user-supplied arguments into shell commands, detection involves testing these inputs for command injection.

A proof of concept involves injecting shell metacharacters into parameters such as projectPath, scheme, configuration, or destination to execute arbitrary commands. For example, injecting a command like `id >&2` into the scheme parameter can reveal if command injection is possible.

Detection commands might include sending crafted requests to the MCP interface with payloads that close existing quotes and append commands, then observing the server response or error output for command execution results.

• Use network tools or scripts to send requests to the MCP interface with payloads such as: `scheme=validScheme;id >&2` or `scheme=validScheme && id >&2`.
• Monitor server logs or error outputs for evidence of command execution, such as output from `id` or other injected commands.
• Use static analysis tools or MCP Inspector to analyze the source code for unsafe use of `child_process.exec` with user inputs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including full host compromise. An attacker can execute arbitrary OS commands with the privileges of the server process, which can lead to:

• Exposure of sensitive data on the host system.
• Loss of data integrity by modifying or deleting files.
• Disruption of services running on the host, causing denial of service.

Because the attack can be launched remotely without authentication, any system running the vulnerable version of xcode-mcp-server is at high risk.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote OS command injection leading to full host compromise, including data exposure, integrity loss, and service disruption.

Such impacts on confidentiality, integrity, and availability of data could negatively affect compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system integrity.

However, no explicit mention of compliance impact or regulatory considerations is provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling the vulnerable tools `build_project` and `run_tests` to prevent exploitation.

Avoid executing shell commands with user-supplied input directly. Instead, use safer alternatives such as `execFile` or `spawn` that do not invoke a shell.

Validate all user inputs against strict allowlists to prevent injection of shell metacharacters.

Run the server with the least privileges necessary to limit the impact of a potential compromise.

Apply or develop patches that replace unsafe `exec` calls with safer methods and add regression tests to prevent reintroduction of the vulnerability.

Useful 0 Not Useful 0