idachev mcp-javadc OS Command Injection via HTTP Interface (CVE-2026-5802)

A critical OS command injection vulnerability, CVE-2026-5802, has been identified in idachev mcp-javadc, a Java decompiler, up to version 1.2.4. The vulnerability resides within the HTTP Interface component. By manipulating the jarFilePath argument, a remote attacker can inject and execute arbitrary operating system commands on the server. This vulnerability is remotely exploitable without authentication, increasing the severity. Publicly available exploits exist, potentially leading to widespread exploitation. The vendor has been notified through an issue report but has not yet responded.

Attack Chain

1. The attacker sends a malicious HTTP request to the vulnerable mcp-javadc server.
2. The HTTP request targets the HTTP Interface component.
3. The attacker crafts the request to manipulate the jarFilePath argument.
4. The server-side code fails to properly sanitize the jarFilePath argument.
5. The unsanitized jarFilePath argument is passed to an operating system command.
6. The injected OS command is executed by the server with the privileges of the mcp-javadc process.
7. The attacker gains arbitrary code execution on the server.
8. The attacker can then perform further actions, such as data exfiltration, lateral movement, or denial of service.

Impact

Successful exploitation of CVE-2026-5802 allows unauthenticated remote attackers to execute arbitrary operating system commands on the affected system. This can lead to complete system compromise, including data theft, malware installation, and denial of service. As this vulnerability affects a software development tool, successful attacks could compromise software build pipelines, leading to supply chain attacks. The number of potential victims is currently unknown, but given the publicly available exploit, the risk of widespread exploitation is high.

Recommendation

• Apply available patches for mcp-javadc if they become available.
• Deploy the Sigma rule Detect Suspicious JarFilePath Parameter in HTTP Request to identify exploitation attempts targeting the jarFilePath parameter.
• Monitor web server logs for unusual HTTP requests containing suspicious characters or command sequences within the jarFilePath parameter.
• Implement input validation and sanitization measures on the server-side to prevent command injection.
• Place the affected server in an isolated network segment to limit the impact of potential compromise.