Executive brief
xcode-mcp-server is a Model Context Protocol server that provides tools for interacting with Xcode and iOS development environments. A command injection vulnerability in the LLDB debugging tool allows authenticated users to execute arbitrary system commands with the privileges of the MCP service process, potentially leading to full compromise of the development environment or host system depending on how the service is deployed.
Technical details
The vulnerability is a command injection (CWE-74, CWE-77) in the registerXcodeTools function within src/tools/xcode/index.ts, specifically in the run_lldb tool. The vulnerable code uses child_process.exec() to execute LLDB commands without proper sanitization of the args parameter, allowing an attacker to inject shell metacharacters and execute arbitrary commands. The attack requires authentication to the MCP service and network access to the endpoint. An attacker can break out of the intended LLDB command context using shell operators (e.g., `&` or `;`) to execute arbitrary code. A patch has been identified (commit 11f8d6bacadd153beee649f92a78a9dad761f56f) and should be applied to resolve the issue.
Affected products
- r-huijts xcode-mcp-server up to 1.0.3
Timeline
- 2026-01-31: disclosed: Security report filed on GitHub issues
- 2026-02-08: advisory: GHSA advisory published
- 2026-02-08: patched: Patch commit 11f8d6bacadd153beee649f92a78a9dad761f56f available