@iflow-mcp/theycallmeholla-schema-org-mcp (0.1.0), @wonderwhy-er/desktop-commander (>=0.2.29-alpha.3, <=0.2.29-alpha.4) +2 more potentially affected by CVE-2025-11491 via @wonderwhy-er/desktop-commander (>=0.1.39, <=0.2.47)

@wonderwhy-er/desktop-commander NPM version =0.1.39, =0.2.29-alpha.3, =1.0.0, =1.0.1 - familiar-mcp 0.1.0 Source cves: CVE-2025-11491 Source advisory: SNYK:JS-WONDERWHYERDESKTOPCOMMANDER-13535096...

CVE-2025-11491

A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made...