CVE-2026-3680

RyuzakiShinji biome-mcp-server (up to 1.0.0) contains a vulnerability in biome-mcp-server.ts that allows remote command injection via a manipulated input. The issue affects the server’s unknown functionality and can be triggered remotely; a public exploit exists. A patch is available (hash: 335e1...

CVE-2026-3680: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in RyuzakiShinji biome-mcp-server up to 1.0.0. Affected by this issue is some unknown functionality of the file biome-mcp-server.ts. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit has been released to t...