Unreal MCP Server

A long base64-looking blob appears alongside a decode/execute instruction — a common way to hide a payload from reviewers.

Evidence: Take a screenshot of the Unreal Editor Example output: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAA... Returns a base64-encoded PNG image of the current edi

Location: tool editor_take_screenshot · description

In the server's implementation (`dist/utils.js:5`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: vars = {}) { return new Function(...Object.keys(vars), `return \`${tmpl}\`;`)(...Object.values(vars)); }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/utils.js

In the server's implementation (`dist/utils.js:5`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: vars = {}) { return new Function(...Object.keys(vars), `return \`${tmpl}\`;`)(...Object.values(vars)); }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/utils.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/scripts/make-executable.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ue: true }); const node_child_process_1 = require("node:child_process"); // https://github.com/modelcontextprotocol/insp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/scripts/make-executable.js