Command Injection

Overview mcp-watch is a Security scanner for Model Context Protocol MCP servers - detect vulnerabilities and security issues Affected versions of this package are vulnerable to Command Injection via the cloneRepo function in the /scanner/McpScanner.ts file. An attacker can execute arbitrary...

CVE-2025-66401 MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL

MCP Watch is a comprehensive security scanner for Model Context Protocol MCP servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via...

CVE-2025-66401: Improper Neutralization of Special Elements used in an OS Command

MCP Watch is a comprehensive security scanner for Model Context Protocol MCP servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command Injection vulnerability in the cloneRepo method. The application passes the user-supplied githubUrl argument directly to a system shell via...