CVE-2026-105797: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in microsoft simplechat
Description
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.
CVSS v3.1
Score 8.8high
Affected software
microsoft
simplechat
pkg:github/microsoft/simplechatRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Microsoft SimpleChat versions 0.261.003 and 0.261.027 contain an authorization ordering flaw in the POST /api/user/plugins API. A low-privileged authenticated user can omit the top-level MCP type, causing the _reject_non_admin_mcp_stdio check to be skipped before the type is restored from metadata. This allows a stored personal action to reach McpPluginFactory.create_connector, and subsequently MCPStdioPlugin.connect starts an attacker-selected OS process under the application service identity. Exploitation requires that personal plugins are enabled and governance permits MCP actions. The vulnerability enables OS command injection, potentially exposing or modifying secrets and data available to the service or disrupting the service. The flaw is resolved in version 0.261.031.
Potential Impact
Successful exploitation allows an authenticated low-privileged user to execute arbitrary operating system commands under the application service identity. This can lead to exposure or modification of sensitive secrets and data accessible to the service, and may disrupt service availability. The vulnerability has a CVSS v3.1 score of 8.8 (high severity), reflecting high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade Microsoft SimpleChat to version 0.261.031 or later, where this vulnerability is fixed. Ensure that personal plugins and MCP actions are governed appropriately. No additional mitigation is required once the fixed version is deployed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-05T20:37:19.364Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac506e32cdf04f656b9a061
Added to database: 10/06/2026, 14:34:11 UTC
Last enriched: 10/06/2026, 14:48:21 UTC
Last updated: 10/06/2026, 18:57:27 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.