CVE-2026-7443
BurtTheCoder mcp-dnstwist MCP index.ts fuzz_domain os command injection
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4. Affected by this vulnerability is the function fuzz_domain of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument Request can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-78 CWE-77 |
| Vendor | burtthecoder |
| Product | mcp-dnstwist |
| Published | Apr 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for burtthecoder mcp-dnstwist
Be the first to know when new high vulnerabilities affecting burtthecoder mcp-dnstwist are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
BurtTheCoder / mcp-dnstwist
1.0.0 1.0.1 1.0.2 1.0.3 1.0.4
References
vuldb.com: https://vuldb.com/vuln/360185 vuldb.com: https://vuldb.com/vuln/360185/cti vuldb.com: https://vuldb.com/submit/804027 github.com: https://github.com/BurtTheCoder/mcp-dnstwist/issues/13 github.com: https://github.com/BruceJqs/public_exp/issues/22 github.com: https://github.com/BurtTheCoder/mcp-dnstwist/
Credits
🔍 _Eternity_ (VulDB User) VulDB CNA Team