Executive Summary

CVE-2026-7642 is a command injection vulnerability in the pskill9 website-downloader tool, specifically in the download_website function of the MCP Interface component. The vulnerability occurs because the tool constructs a wget command by directly concatenating user-supplied arguments, including outputPath, into a shell command string executed via child_process.exec without proper escaping or argument separation.

An attacker with network access to the MCP interface can inject shell metacharacters (such as ; or &&) into the outputPath parameter, allowing execution of arbitrary operating system commands with the privileges of the server process. This can lead to full host compromise.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including full host compromise. An attacker can execute arbitrary OS commands on the server hosting the website-downloader tool, which may result in data exposure, loss of data integrity, and disruption of services.

• Data exposure due to unauthorized command execution.
• Integrity loss by modifying or deleting data.
• Service disruption caused by executing malicious commands.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious usage of the download_website tool, especially requests that include shell metacharacters in the outputPath parameter.

A proof of concept involves sending a request with a malicious outputPath containing shell metacharacters such as "; id #" which executes arbitrary OS commands.

To detect exploitation attempts, you can look for unusual command executions or network requests invoking the download_website tool with suspicious parameters.

• Check logs for commands or requests containing shell metacharacters like ;, &&, or backticks in the outputPath argument.
• Use network monitoring tools to detect requests to the MCP interface that include suspicious outputPath values.
• If you have access to the server, monitor process executions for wget commands constructed with unescaped user input.
• Example command to search logs for suspicious outputPath usage: grep -E 'outputPath=.*[;&`]' /var/log/your_application.log

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the download_website tool to trusted users or networks.

Reject or sanitize any shell metacharacters in the outputPath parameter to prevent command injection.

Run the server process with the lowest possible privileges to limit the impact of a potential exploit.

Avoid using child_process.exec for command execution; instead, use safer alternatives like child_process.execFile or spawn that do not invoke a shell.

Validate all inputs rigorously and add regression tests to detect injection attempts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to execute arbitrary OS commands on the server hosting the website-downloader tool, potentially leading to full host compromise.

Such a compromise can result in unauthorized data exposure, loss of data integrity, and service disruption.

These impacts can negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of data confidentiality, integrity, and availability.

Specifically, unauthorized data exposure could violate data privacy requirements, while integrity loss and service disruption could breach operational and security controls mandated by these regulations.

Useful 0 Not Useful 0