Command Injection Vulnerability in PhialsBasement Nmap CLI Command Handler
CVE-2026-3484

5.3MEDIUM

Key Information:

Vendor

Phialsbasement

Status
Nmap-mcp-server
Vendor
CVE Published:
3 March 2026

What is CVE-2026-3484?

A command injection vulnerability exists in the Nmap CLI Command Handler of PhialsBasement's nmap-mcp-server, specifically in the child_process.exec function of src/index.ts. This flaw could allow remote attackers to execute arbitrary commands on affected systems. The product follows a rolling release model, so specific version information for affected releases is undisclosed. It is crucial for users to apply the provided patch (30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488) to mitigate this security risk.

Affected Version(s)

nmap-mcp-server bee6d23547d57ae02460022f7c78ac0893092e38

References

https://vuldb.com/?id.348559
vdb-entrytechnical-description
https://vuldb.com/?ctiid.348559
signaturepermissions-required
https://vuldb.com/?submit.763773
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yinci Chen (VulDB User)
.