Vulnerability · Published Jul 18, 2026 · Assigned by VulDB

CVE-2026-16133LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection

Medium 5.0

In plain English

A medium-severity command injection in MiniCode from LiuMengxuan04. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)1.2%top 31.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manipulation can lead to command injection. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

Vendor	Product	Versions
LiuMengxuan04	MiniCode	0.1.0

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-379853 | LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection vdb-entry, technical-description
VDB-379853 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-16133 | CVE Analysis and Report third-party-advisory
Submit #856976 | LiuMengxuan04 MiniCode 0.1.0 Command Injection third-party-advisory
https://github.com/LiuMengxuan04/MiniCode/issues/35 issue-tracking
https://github.com/LiuMengxuan04/MiniCode/pull/37 issue-tracking, patch
https://gist.github.com/menelausx/b42381d2788a334cba8cda43f52e2a28 exploit
https://github.com/LiuMengxuan04/MiniCode/ product