CVE-2026-10691

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10691 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10691 Source advisory:...

Server-side Request Forgery (SSRF)

Overview @wonderwhy-er/desktop-commander is a MCP server for terminal operations and file editing Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the readFileFromUrl function in filesystem.ts when processing the url argument. An attacker can access interna...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10690 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10690 Source advisory:...

GHSA-5XX3-J724-WMX5 DesktopCommanderMCP is vulnerable to SSRF

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component readfile. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10690 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10690 Source advisory: OSV:GHSA-5XX3-J724-WMX...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10691 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10691 Source advisory: OSV:GHSA-R87G-78MX-3WG...

EUVD-2026-34056

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

CVE-2026-10690

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component readfile. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote...

Desktop Commander MCP 安全漏洞

Desktop Commander MCP is an MCP server developed by Eduard Ruzga. Version 0.2.37 of Desktop Commander MCP contains a security vulnerability. This vulnerability stems from the handling of the url parameter in the readFileFromUrl function found in the src/tools/filesystem.ts file. This vulnerabilit...

Desktop Commander MCP 安全漏洞

Desktop Commander MCP is an MCP server developed by Eduard Ruzga. Versions of Desktop Commander MCP prior to 0.2.38 contained security vulnerabilities. These vulnerabilities stemmed from the operation of the startsearch component in the src/search-manager.ts file with respect to the SearchResult...

CVE-2026-10691 wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

CVE-2026-10691

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

CVE-2026-10690 wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component readfile. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote...

PT-2026-45884

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote...

PT-2026-45885

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start search. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It i...

CVE-2025-11491

A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made...

CVE-2025-11489

A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The...

CVE-2025-11490

A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from...

@gustavoduartecloser/dc-wrapper (>=1.0.0, <=3.0.0), @iflow-mcp/theycallmeholla-schema-org-mcp (0.1.0) +3 more potentially affected by CVE-2025-11491 via @wonderwhy-er/desktop-commander (>=0.1.39, <=0.2.47)

@wonderwhy-er/desktop-commander NPM version =0.1.39, =1.0.0, =0.2.29-alpha.3, =1.0.0, =1.0.1 - familiar-mcp 0.1.0 Source cves: CVE-2025-11491 Source advisory: SNYK:JS-WONDERWHYERDESKTOPCOMMANDER-13535096...