A critical OS command injection vulnerability (CVE-2026-7416) was discovered in PolarVista xcode-mcp-server version 1.0.0. The vulnerability affects the build_project/run_tests functions in src/index.ts of the MCP Interface component. Attackers can manipulate the Request argument to achieve remote code execution through OS command injection. The exploit has been publicly disclosed and could be actively used. The vendor has been notified through an issue report but has not responded to the disclosure.