MediumPublic exploit

CVE-2026-3484

IdentifiersCVE-2026-3484

A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function child_process.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may be performed from remote. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The patch is identified as 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. It is best practice to apply a patch to resolve this issue.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2026-52616MaturityOperationalVerified exploit

This five-file repository is a JavaScript proof-of-concept and advisory for an OS command injection in the npm package mcp-nmap-server (repository name nmap-mcp-server). It contains documentation, an MIT license, a gitignore file, and one executable PoC at `poc/driver.mjs`; it does not include the vulnerable server source itself. The README identifies CVE-2026-52616 as a duplicate of CVE-2026-3484 / GHSA-xc68-rrqc-qgq3 and states that all published mcp-nmap-server releases through 1.0.1 are affected. The issue is CWE-78: `run_nmap_scan` constructs an nmap command using attacker-controlled `target` and `additionalFlags`, then executes the resulting string with Node.js child_process.exec, which invokes a Unix shell. The driver starts `dist/index.js` as a child process, performs MCP initialization over stdio, and invokes `run_nmap_scan` with a semicolon-delimited target containing a benign `touch` command. It checks whether `/tmp/PWNED_nmap` was created and exits 0 on confirmation. The demonstrated impact is arbitrary command execution as the MCP server user; a network-exposed wrapper around the otherwise stdio-based MCP service could make attacker delivery remotely reachable, but this PoC itself uses only local stdio.

s1koDisclosed Aug 22, 2026javascriptlocal

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

PhialsbasementMcp Nmap Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1