CVE-2026-7215 egtai CVE debrief

Who should care

Users of egtai gmx-vmd-mcp up to 0.1.0, operators, platform administrators, vulnerability management teams, and security teams should be aware of this vulnerability and take necessary actions to protect their systems.

Technical summary

A command injection vulnerability exists in egtai gmx-vmd-mcp up to 0.1.0. The vulnerability affects the function launch_vmd_gui_tool of the file mcp_server.py of the component VMD Launch Handler. An attacker can inject commands by manipulating the argument structure_file/trajectory_file. The attack can be launched remotely. This vulnerability has a CVSS score of 5.5 and is considered Medium severity.

Defensive priority

Medium priority should be given to patching this vulnerability as it has a CVSS score of 5.5 and can be exploited remotely.

Recommended defensive actions

• Apply the patch or update to the latest version of egtai gmx-vmd-mcp
• Restrict access to the VMD Launch Handler
• Monitor for suspicious activity
• Implement input validation and sanitization
• Consider compensating controls such as Web Application Firewalls
• Review and verify affected scope and vendor guidance
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-04-28T03:16:04.430Z and was last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Deferred. The egtai gmx-vmd-mcp project has not responded to the issue report yet. Users should verify their deployments and review official advisories for affected scope and vendor guidance.

Official resources