CVE-2026-7443: BurtTheCoder mcp-dnstwist OS Command Injection

The National Vulnerability Database has detailed CVE-2026-7443, a high-severity OS command injection vulnerability impacting BurtTheCoder’s mcp-dnstwist tool, specifically versions up to 1.0.4. The flaw resides within the fuzz_domain function of the src/index.ts file, a component of the MCP Interface. An attacker can remotely trigger this vulnerability by manipulating the Request argument.

This is not a theoretical threat. The exploit has been publicly released, meaning attackers can immediately leverage it. The project maintainers were notified via an issue report but, according to the National Vulnerability Database, have yet to respond. This lack of response leaves users exposed to a critical vulnerability with a CVSS score of 7.3.

Organizations utilizing mcp-dnstwist are at significant risk. An OS command injection allows an attacker to execute arbitrary commands on the underlying system, potentially leading to full system compromise, data exfiltration, or further network penetration. The attacker’s calculus here is straightforward: exploit an unpatched, publicly known vulnerability for direct system access.