CVE-2026-30625 - Vulnerability Analysis

Overview

Upsonic 0.71.6 contains a remote code execution caused by insufficient command argument validation in MCP server/task creation, letting attackers execute arbitrary OS commands with Upsonic process privileges, exploit requires crafted MCP tasks.

Severity & Score

Impact

Attackers can execute arbitrary OS commands remotely with Upsonic process privileges, potentially compromising the system.

Mitigation

Update to version 0.72.0 or later.

References

• https://github.com/Upsonic/Upsonic/commit/855053fce0662227d9246268ff4a0844b481a305
• https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 18, 2026

🔴 CVE-2026-30625 - Critical (9.8) Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed com... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30625/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner