CVE-2026-19332 is a command injection vulnerability in MCP4EDA's view_waveform component—a tool that processes VCD (Value Change Dump) files from semiconductor simulations. The CVSS 5.3 score is technically accurate for its authenticated, local-attacker model, but it materially understates the risk in EDA deployment contexts.
The view_waveform component takes design names or file paths and appears to interpolate them directly into shell commands. In most EDA environments, 'local access' means a shared workstation or build server that already holds access tokens to revision control systems containing proprietary RTL, GDSII files, or tape-out artifacts. The attacker doesn't need to escalate—they're already standing in the server room. Additionally, MCP4EDA exposes JSON-RPC endpoints as a Model Context Protocol server. This means any compromised client that connects to the MCP server—say, a cursor session or AI coding assistant configured to use MCP4EDA—can inject payloads through the protocol layer without ever touching the host console. The 'local access required' qualifier describes the server's host, not the attacker's position. Compromising a connected client is a remote operation that routes through the protocol to the daemon.
This matters because EDA workflows run overnight batch jobs on build servers with access to multiple design repositories. A compromised MCP4EDA invocation in a CI pipeline doesn't affect one project—it potentially affects every design passing through that server during the compromise window. The damage model isn't server downtime; it's supply chain integrity erosion at the IP layer, measured in years of R&D and competitive advantage.
The project hasn't responded to the disclosure. Combined with the direct shell interpolation in a 1.0.0 release, this suggests either no security disclosure process or a development culture that hasn't internalized input sanitization as a first principle. Either way, the view_waveform component is almost certainly not the only injection surface. EDA tools like OpenSTA and OpenROAD have powerful CLI interfaces but notoriously absent or stable programmatic APIs—developers building wrappers face a choice between weeks of IPC binding work or a simple subprocess call. That ecosystem pressure produces systematic shell interpolation across similar tooling.
Treat this as a supply chain risk, not just a host vulnerability. Map which workstations and build servers run MCP4EDA, audit the subprocess call patterns in the codebase, and treat any unpatched EDA wrapper tool as a multi-project trust boundary. The vulnerable version will persist in locked-in build environments far longer than typical software—EDA toolchains get frozen at specific versions and persist across tape-out cycles spanning years.