CVE-2026-6942 is an OS command injection vulnerability in radareorg's radare2-mcp (version 1.6.0 and earlier). The vulnerability stems from improper sanitization of user-controlled input passed to the r2_cmd_str() function, allowing attackers to bypass command filters using shell metacharacters. This can be exploited remotely via the jsonrpc interface without authentication, enabling arbitrary command execution on the host system. The vulnerability is classified under CWE-78 and has a CVSS 4.0 base score of 9.3, indicating critical severity. No patch or official remediation level has been published as of the data provided.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the host running radare2-mcp, potentially leading to full system compromise. The vulnerability affects all versions up to and including 1.6.0. There are no known exploits in the wild at this time. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the jsonrpc interface to trusted networks or disable the vulnerable service if possible to reduce exposure.