High 8.8Published Oct 6, 2026

CVE-2026-105797SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)

Updated under an hour ago (2026-10-19 07:30 UTC)

Does this affect you?

It affects microsoft simplechat. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.56%, higher than 46% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for microsoft simplechat

Exploited in the last 30 days

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78, CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.56% (percentile 46)
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 6, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

microsoft simplechat microsoft:simplechat (from the name)	before 0.261.031	CNA record

References

https://github.com/microsoft/simplechat/security/advisories/GHSA-h4mw-qw8m-5x4jx-refsource-confirm
https://github.com/microsoft/simplechat/commit/73ff7d6998dc4827a0f6ba002386275a7c1ec804x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.