Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 15, 2026 · NIST NVD

   Detected

   Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to the network-accessible Jaaz application, causing attacker-controlled commands to be executed on the server. Successful exploitation results in arbitrary command execution within the context of the Jaaz service, potentially allowing full comp

2. Jun 17, 2026 · NIST NVD

   Updated

   Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to the network-accessible Jaaz application, causing attacker-controlled commands to be executed on the server. Successful exploitation results in arbitrary command execution within the context of the Jaaz service, potentially allowing full comp

Sources

• CVE.orgVulnerability recordCVE-2026-30616

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-30616

  Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to the network-accessible Jaaz application, causing attacker-controlled commands to be executed on the server. Successful ex

  nvd.nist.gov

References

• Reference · ox.security