## Summary
In the latest version v0.1.0 of **[HarmonyOS-mcp-server](https://github.com/XixianLiang/HarmonyOS-mcp-server)** MCP, the `input_text` tool has a code injection vulnerability. This allows users to execute arbitrary code.
- CWE-78 OS Command Injection
- - vendor: https://github.com/XixianLiang/HarmonyOS-mcp-server
## Author
Lexpl0it、fcgboy、ch0wn、Sanny
## DATE 
2026/01/16

## Details
The `text` parameter of the `input_text` tool provided by MCP uses the `asyncio.create_subprocess_shell` function for parse. This leads to arbitrary code execution.
![](./images/Pasted%20image%2020260115105545.png)
![](./images/Pasted%20image%2020260116103315.png)


# POC
```
调用input_text，center为(1,2), text为"zzz&calc"
```
- Screenshot

![](./images/Pasted%20image%2020260115105514.png)

## Impact

The impact varies depending on the deployment mindset of the MCP service.

| MCP Deployment Model                     | Practical Impact of Command Injection                               |
| ---------------------------------------- | ------------------------------------------------------------------- |
| **Local MCP (no sandbox)**               | Arbitrary command execution with the **current user’s privileges**  |
| **Local MCP (with strong sandboxing)**   | Command execution **confined within the sandbox environment**       |
| **Remote MCP (single-tenant / private)** | **Remote server RCE**, scope depends on host isolation              |
| **Remote MCP (multi-tenant / SaaS)**     | **Critical cross-tenant compromise**, potential full service breach |

## Statement
I confirm that the information in this report is true and accurate, and it is intended solely for security research and vulnerability remediation purposes, not for malicious use.

# TimeLine
January 16, 2026: Vulnerability discovered
January 19, 2026: Author XixianLiang notified
January 24, 2026: Author confirms the vulnerability exists