CVE-2026-5602

CVE-2026-5602 is an OS command injection vulnerability identified in Nor2-io heim-mcp versions up to 0.1.3, specifically within the registerTools function of src/tools.ts. The flaw affects the new heim application and cloud deployment components, allowing attackers to execute arbitrary system commands through the vulnerable function. The vulnerability carries a CVSS v3.1 score of 5.3 (Medium severity), with a local attack vector requiring low complexity and user privileges but no interaction. The impact is limited to confidentiality, integrity, and availability at the local level. The EPSS score of 0.0008 indicates this vulnerability is not currently widespread among exploited CVEs in the wild. Exploitation currently requires local access to the affected system. While the vulnerability has been publicly disclosed, there is no evidence of active exploitation, and the vulnerability does not appear on the Known Exploited Vulnerabilities catalog. The vendor responded professionally and released a patched version (commit c321d8af25f77668781e6ccb43a1336f9185df37), and organizations should prioritize upgrading to the fixed version to mitigate this risk.