UnBattletech

UnBattletech — 逆向工程 BattleTech: The Crescent Hawk's Inception 1988 对 Infocom 于 1988 年推出的 MS-DOS 游戏 BattleTech: The Crescent Hawk's Inception 进行逆向工程分析，并使用 Godot 4 + C 重建。 仓库结构 root@kitploit: ├── docs/ RE documentation & findings │ ├── CONTEXT.md Master context 1050+ lines │ ├── TECHNICALANALYSIS.m...

CVE-2026-25546-godot-mcp-0.1.1-OS-Command-Injection

CVE-2026-25546 PoC - godot-mcp 操作系统命令注入 作者： Mohammed Idrees Banyamer GitHub： mbanyamer 日期： 2026年2月4日 漏洞标题 godot-mcp 0.1.1 - 通过 projectPath 实现操作系统命令注入 CVE CVE-2026-25546 CWE CWE-78（OS命令中使用的特殊元素未正确中和 - 操作系统命令注入） 厂商 Coding-Solo / godot-mcp 受影响版本 0.1.1 修复版本 0.1.1 补丁提交...

Malicious code in godot-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edb0e7385ab0574f7223206d79822362c142c664b0aed0ae5a00546b6bb38ef4 lang/gdscript.js appends a hostile IIFE after module.exports that runs when the module is require'd reachable via lang/loader.js and test.js. The...

CVE-2026-19044

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

EUVD-2026-53934

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

CVE-2026-19044

CVE-2026-19044 affects LeeSinLiang godot-mcp 0.1.0. The vulnerability is in the function executeOperation of src/index.ts within the create_scene/add_node component, where manipulation of the argument projectPath allows command injection. Exploitation requires local access. The report notes the i...

CVE-2026-15522

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

CVE-2026-15522

The CVE-2026-15522 entry concerns the tugcantopaloglu godot-mcp package, version 2.0.0. Affected is the function validatePath in build/index.js (component run_project); manipulating the argument projectPath enables path traversal. Exploitation requires local access, and a public exploit has been ...

CVE-2026-15522

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

CVE-2026-15522 tugcantopaloglu godot-mcp run_project index.js validatePath path traversal

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

CVE-2026-15522 tugcantopaloglu godot-mcp run_project index.js validatePath path traversal

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

Command Injection

Godot MCP is vulnerable to Command Injection. The vulnerability is due to passing user-controlled input directly to exec without sanitization, which allows an attacker to inject shell commands and achieve remote code execution...

CVE-2026-25546

Godot MCP is a Model Context Protocol MCP server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input e.g., projectPath directly to exec, which...

Exploit for CVE-2026-25546

CVE-2026-25546 PoC - godot-mcp OS Command...

CVE-2026-25546

Godot MCP is a Model Context Protocol MCP server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input e.g., projectPath directly to exec, which...

CVE-2026-25546 Godot MCP is vulnerable to Command Injection via unsanitized projectPath

Godot MCP is a Model Context Protocol MCP server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input e.g., projectPath directly to exec, which...

CVE-2026-25546 Godot MCP is vulnerable to Command Injection via unsanitized projectPath

Godot MCP is a Model Context Protocol MCP server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input e.g., projectPath directly to exec, which...

CVE-2026-25546

Godot MCP vulnerability CVE-2026-25546: In godot-mcp prior to v0.1.1, executeOperation passed user-controlled input (e.g., projectPath) to exec(), spawning a shell and enabling command injection with shell metacharacters. This could allow remote code execution with MCP server privileges across to...

CVE-2026-25546 Godot MCP is vulnerable to Command Injection via unsanitized projectPath

Godot MCP is a Model Context Protocol MCP server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input e.g., projectPath directly to exec, which...

EUVD-2026-5327

Godot MCP is a Model Context Protocol MCP server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input e.g., projectPath directly to exec, which...