CVE-2026-30616
Published: 15 April 2026
Summary
CVE-2026-30616 is a high-severity Command Injection (CWE-77) vulnerability in Ox (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-30616 is a remote code execution vulnerability in Jaaz version 1.0.30, published on 2026-04-15. The issue stems from improper handling of MCP STDIO command execution, classified under CWE-77 (Command Injection) with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It affects the network-accessible Jaaz application, where crafted network requests can trigger execution of attacker-controlled commands on the server.
A remote attacker requires only network access to the Jaaz application and can exploit the vulnerability without privileges, authentication, or user interaction due to its low attack complexity. Exploitation leads to arbitrary command execution in the context of the Jaaz service, with potential for full system compromise given the low impacts across confidentiality, integrity, and availability.
The primary advisory is available from OX Security at https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/, which covers this vulnerability alongside other RCE issues in the MCP supply chain within the AI ecosystem.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22939
Vulnerability details
Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to the network-accessible Jaaz application, causing attacker-controlled commands to be executed on the server. Successful exploitation results…
more
in arbitrary command execution within the context of the Jaaz service, potentially allowing full compromise of the affected system.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE via command injection on network-accessible app directly enables T1190 (Exploit Public-Facing Application) for initial access and T1059 (Command and Scripting Interpreter) for arbitrary command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates command injection (CWE-77) by validating crafted network inputs to the Jaaz application's MCP STDIO command execution handling before processing.
Ensures timely identification, reporting, and remediation of the specific RCE flaw in Jaaz 1.0.30, preventing exploitation via patching or upgrades.
Monitors and controls network communications at boundaries to the Jaaz application, blocking or detecting crafted requests targeting the STDIO vulnerability.