Threats affecting pkg:github/polarvista/xcode-mcp-server

CVE-2026-7416 is an OS command injection vulnerability in PolarVista xcode-mcp-server version 1.0.0. The issue exists in the build_project/run_tests function within the MCP Interface component, where manipulation of the Request argument can lead to command injection. This vulnerability can be exploited remotely without authentication. Although the vulnerability was reported early, the vendor has not yet responded or provided a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity level. There is no official patch or remediation available at this time, and no known exploits have been observed in the wild.