Command Injection

Overview mcp-watch is a Security scanner for Model Context Protocol MCP servers - detect vulnerabilities and security issues Affected versions of this package are vulnerable to Command Injection via the cloneRepo function in the /scanner/McpScanner.ts file. An attacker can execute arbitrary...

CVE-2025-66401 MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL

MCP Watch is a comprehensive security scanner for Model Context Protocol MCP servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via...

CVE-2025-66401: Improper Neutralization of Special Elements used in an OS Command

MCP Watch is a comprehensive security scanner for Model Context Protocol MCP servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via...

PT-2017-2906

Name of the Vulnerable Software and Affected Versions Atlassian SourceTree versions 2.5c and prior Description The issue exists due to a lack of neutralization of special elements used in operating system commands. Exploitation may allow a remote attacker to execute arbitrary commands by...