PT-2026-68495

Name of the Vulnerable Software and Affected Versions MissionSquad mcp-api versions prior to 1.11.9 Description Command injection is possible via remote attack in the NPM Package Version Handler component. The issue resides in the this.packageService.installPackage function within the...

PT-2026-68494

Name of the Vulnerable Software and Affected Versions MissionSquad mcp-api versions prior to 1.11.10 Description A remote flaw exists in a function within the src/services/dcrClients.ts file. This issue allows for server-side request forgery, a technique where an attacker induces the server to ma...

CVE-2026-19041: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...

CVE-2026-19040: Server-Side Request Forgery (SSRF)

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...