CVE-2026-3484 is a command injection vulnerability found in the PhialsBasement nmap-mcp-server, a component that handles Nmap CLI commands. The vulnerability exists in the child_process.exec function within the src/index.ts file of the Nmap CLI Command Handler. Due to insufficient input validation or sanitization, an attacker can inject arbitrary commands that the server executes on the host operating system. This flaw can be exploited remotely without requiring user interaction or elevated privileges beyond low-level access, making it relatively easy to exploit over the network. The product employs a rolling release model, so specific version numbers are not disclosed; however, the affected commit is bee6d23547d57ae02460022f7c78ac0893092e38, and a patch is available in commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488. The vulnerability impacts confidentiality, integrity, and availability to a limited extent, as the attacker can execute arbitrary commands but may be constrained by the privileges of the compromised process. No known exploits have been reported in the wild, but the potential for abuse exists given the nature of command injection. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to execute arbitrary commands on systems running the vulnerable nmap-mcp-server component. This can lead to unauthorized access to sensitive information, modification or deletion of data, disruption of services, or further lateral movement within a network. Since the attack requires only low privileges and no user interaction, it lowers the barrier for exploitation. Organizations relying on this software for network scanning or management could face operational disruptions or data breaches. The rolling release nature of the product means some deployments may lag in patching, increasing exposure. While no active exploitation is currently known, the vulnerability poses a moderate risk, especially in environments where the nmap-mcp-server is exposed to untrusted networks or integrated into critical infrastructure.

1. Apply the official patch identified by commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488 immediately to remediate the vulnerability. 2. Restrict network access to the nmap-mcp-server service using firewalls or network segmentation to limit exposure to trusted hosts only. 3. Implement strict input validation and sanitization on all inputs passed to child_process.exec or similar command execution functions to prevent injection. 4. Run the nmap-mcp-server with the least privileges necessary to limit the impact of potential exploitation. 5. Monitor logs and network traffic for unusual command execution patterns or anomalies indicative of exploitation attempts. 6. Employ application-layer firewalls or intrusion detection systems with signatures targeting command injection attempts against this component. 7. Educate development teams on secure coding practices to avoid similar injection flaws in future releases. 8. Regularly audit and update all dependencies and components in the software supply chain to ensure timely patching of vulnerabilities.