999 matches found
Command Injection
Overview @wonderwhy-er/desktop-commander is a MCP server for terminal operations and file editing Affected versions of this package are vulnerable to Command Injection via the extractBaseCommand function. An attacker can execute arbitrary operating system commands by supplying crafted input that ...
@gustavoduartecloser/dc-wrapper (>=1.0.0, <=3.0.0), @iflow-mcp/theycallmeholla-schema-org-mcp (0.1.0) +3 more potentially affected by CVE-2025-11490 via @wonderwhy-er/desktop-commander (>=0.1.39, <=0.2.48)
@wonderwhy-er/desktop-commander NPM version =0.1.39, =1.0.0, =0.2.29-alpha.3, =1.0.0, =1.0.1 - familiar-mcp 0.1.0 Source cves: CVE-2025-11490 Source advisory: SNYK:JS-WONDERWHYERDESKTOPCOMMANDER-13535095...
CVE-2025-11490
A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from...
@gustavoduartecloser/dc-wrapper (>=1.0.0, <=3.0.0), @iflow-mcp/theycallmeholla-schema-org-mcp (0.1.0) +3 more potentially affected by CVE-2025-11489 via @wonderwhy-er/desktop-commander (>=0.1.39, <=0.2.48)
@wonderwhy-er/desktop-commander NPM version =0.1.39, =1.0.0, =0.2.29-alpha.3, =1.0.0, =1.0.1 - familiar-mcp 0.1.0 Source cves: CVE-2025-11489 Source advisory: SNYK:JS-WONDERWHYERDESKTOPCOMMANDER-13535094...
UNIX Symbolic Link (Symlink) Following
Overview @wonderwhy-er/desktop-commander is a MCP server for terminal operations and file editing Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the isPathAllowed function. An attacker can create a symlink inside an allowed directory that points to a...
EUVD-2025-33288
A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from...
CVE-2025-11489 wonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlink
A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The...
CVE-2025-11489
CVE-2025-11489 affects wonderwhy-er DesktopCommanderMCP up to 0.2.13. The issue resides in isPathAllowed (src/tools/filesystem.ts) and enables symbolic link following, with local access required and high attack complexity. Publicly disclosed exploitability is noted; vendor guidance recommends usi...
Desktop Commander MCP 安全漏洞
Desktop Commander MCP is an MCP server by the individual developer Eduard Ruzga. A security vulnerability exists in Desktop Commander MCP version 0.2.13 and earlier, which stems from the operation of the function isPathAllowed in the file src/tools/filesystem.ts that may result in symbolic link...
Desktop Commander MCP 操作系统命令注入漏洞
Desktop Commander MCP is an MCP server by the individual developer Eduard Ruzga. An operating system command injection vulnerability exists in Desktop Commander MCP version 0.2.13 and earlier, which stems from improper manipulation of the function CommandManager in the file src/command-manager.ts...
Desktop Commander MCP 安全漏洞
Desktop Commander MCP is an MCP server by the individual developer Eduard Ruzga. A security vulnerability exists in Desktop Commander MCP version 0.2.13 and earlier, which stems from os command injection in the extractBaseCommand function of the src/command-manager.ts file in the Absolute Path...
EUVD-2007-0581
Malware in sbrugna...
EUVD-2007-0184
Malware in sbrugna...
EUVD-2007-4737
Malware in sbrugna...
EUVD-2005-4061
Malware in sbrugna...
EUVD-2021-2745
Malware in sbrugna...
EUVD-2004-1003
Malware in sbrugna...
EUVD-2004-1089
Malware in sbrugna...