Executive brief
radare2-mcp is a tool that allows AI agents and LLMs to interact with the radare2 reverse engineering framework. A security flaw allows an attacker to execute arbitrary commands on the host computer running the software without needing any login credentials. This could lead to a full system takeover, especially if an AI agent is tricked into analyzing a malicious file containing hidden instructions.
Technical details
An OS command injection vulnerability exists in radare2-mcp versions 1.6.0 and earlier due to improper neutralization of shell metacharacters in user-controlled input. The vulnerability is reachable via the JSON-RPC interface, specifically through the 'run_javascript' and 'run_command' tools which pass input to the 'r2_cmd_str()' function. Attackers can use the radare2 shell escape character ('!') to bypass command filters and achieve remote code execution (RCE) on the host machine. This can be exploited directly via the network or indirectly through prompt injection if an LLM agent is used to analyze a malicious binary. The issue is fixed in version 1.7.0 by enabling sandbox mode by default.
Affected products
- radareorg radare2-mcp <= 1.6.0
Timeline
- 2026-03-23: disclosed: Issue reported on GitHub by researcher Manthan Ghasadiya
- 2026-04-23: advisory: NVD and VulnCheck published advisory
- 2026-04-23: patched: Fix committed to radare2-mcp repository