MiniMax MCP Search

• Analyzed: May 15, 2026, 4:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: ace00a36f3db131dc408dd000b2519d1c395988cc2910bb6b0fa7bc51bdd06d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `search.py` script is highly vulnerable to shell injection. It uses `subprocess.run` with `shell=True` and directly interpolates user-controlled inputs (`query`, `prompt`, `image_path`) into the shell command strings without proper sanitization. This allows an attacker to execute arbitrary commands on the host system by crafting malicious input for the `web_search` and `understand_image` functions, posing a severe remote code execution risk.