CVE-2026-2178

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb. This affects the function registerXcodeTools of the file src/tools/xcode/index.ts of the component run_lldb. The manipulation of the argument args results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as 11f8d6bacadd153beee649f92a78a9dad761f56f. Applying a patch is advised to resolve this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Feb 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-217834.3HCL Traveler is affected by sensitive information disclosure.  The application generates some error messages that provide detailed informatiCVE-2026-217844.8HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's eCVE-2026-217854.0A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define dCVE-2026-217863.3HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URCVE-2026-217885.4HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code inCVE-2026-217894.6HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2026-21797.2A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-userCVE-2026-217906.3HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional autheCVE-2026-217913.3HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certaiCVE-2026-21808.8A vulnerability was identified in Tenda RX3 16.03.13.11. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manCVE-2026-218069.8HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneoCVE-2026-218073.9HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to caus
CVE-2026-2178: High severity, CVSS 8.8 | Vulnix