CVE-2026-16488
Deferred Deferred - Pending Action

Command Injection in MiniCode-Python

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulDB

Description
A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.1.0-rc1 is able to resolve this issue. This patch is called 9d868dc2550f426c6ddf8ee98f30ffe450ca5e32. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-08-11
AI Q&A
2026-07-22
EPSS Evaluated
2026-08-09
NVD
CVE-2026-16488
EUVD
EUVD-2026-47592

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
qusetions minicode_python 0.1.0
qusetions minicode_python 0.1.0-rc1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in MiniCode-Python 0.1.0. It occurs in the subprocess.Popen function within minicode/config.py. Attackers can exploit it by placing a malicious .mcp.json configuration file in a project. When the victim runs MiniCode-Python, the tool automatically loads this file and executes commands via subprocess.Popen, inheriting the victim's environment. The attack requires cloning a malicious repository and launching MiniCode-Python, which then runs attacker-controlled scripts without user confirmation.

Detection Guidance

Check for suspicious .mcp.json files in project directories. Inspect subprocess.Popen calls in minicode/config.py for unauthorized command execution. Monitor for unexpected child processes spawned by MiniCode-Python.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on your system with the privileges of the MiniCode-Python process. It can lead to unauthorized access to sensitive data like API keys, tokens, or credentials. Attackers could install malware, modify system files, or perform other malicious actions. The impact depends on the permissions of the MiniCode-Python process and the data it can access.

Compliance Impact

This vulnerability could lead to data breaches, exposing sensitive personal or health information. For GDPR, it may result in unauthorized processing of personal data, violating principles of data protection and user consent. For HIPAA, it could compromise protected health information, leading to violations of confidentiality and security rules. Organizations may face fines, legal liabilities, and reputational damage if such breaches occur due to this vulnerability.

Mitigation Strategies
  • Upgrade MiniCode-Python to version 0.1.0-rc1 or later using the patch 9d868dc2550f426c6ddf8ee98f30ffe450ca5e32.
  • Avoid using --trust-project-mcp CLI flag or MINI_CODE_TRUST_PROJECT_MCP=1 environment variable unless absolutely necessary.
  • Manually review .mcp.json files in cloned projects before launching MiniCode-Python.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart