19207 matches found
CVE-2025-11490
A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from...
UNIX Symbolic Link (Symlink) Following
Overview @wonderwhy-er/desktop-commander is a MCP server for terminal operations and file editing Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the isPathAllowed function. An attacker can create a symlink inside an allowed directory that points to a...
@gustavoduartecloser/dc-wrapper (>=1.0.0, <=3.0.0), @iflow-mcp/theycallmeholla-schema-org-mcp (0.1.0) +3 more potentially affected by CVE-2025-11489 via @wonderwhy-er/desktop-commander (>=0.1.39, <=0.2.47)
@wonderwhy-er/desktop-commander NPM version =0.1.39, =1.0.0, =0.2.29-alpha.3, =1.0.0, =1.0.1 - familiar-mcp 0.1.0 Source cves: CVE-2025-11489 Source advisory: SNYK:JS-WONDERWHYERDESKTOPCOMMANDER-13535094...
EUVD-2025-33288
A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from...
CVE-2025-11489 wonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlink
A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The...
CVE-2025-11489
CVE-2025-11489 affects wonderwhy-er DesktopCommanderMCP up to 0.2.13. The issue resides in isPathAllowed (src/tools/filesystem.ts) and enables symbolic link following, with local access required and high attack complexity. Publicly disclosed exploitability is noted; vendor guidance recommends usi...
Desktop Commander MCP 操作系统命令注入漏洞
Desktop Commander MCP is an MCP server by the individual developer Eduard Ruzga. An operating system command injection vulnerability exists in Desktop Commander MCP version 0.2.13 and earlier, which stems from improper manipulation of the function CommandManager in the file src/command-manager.ts...
Desktop Commander MCP 安全漏洞
Desktop Commander MCP is an MCP server by the individual developer Eduard Ruzga. A security vulnerability exists in Desktop Commander MCP version 0.2.13 and earlier, which stems from the operation of the function isPathAllowed in the file src/tools/filesystem.ts that may result in symbolic link...
Desktop Commander MCP 安全漏洞
Desktop Commander MCP is an MCP server by the individual developer Eduard Ruzga. A security vulnerability exists in Desktop Commander MCP version 0.2.13 and earlier, which stems from os command injection in the extractBaseCommand function of the src/command-manager.ts file in the Absolute Path...
BatShadow Group Uses New Go-Based 'Vampire Bot' Malware to Hunt Job Seekers
A Vietnamese threat actor named BatShadow has been attributed to a new campaign that leverages social engineering tactics to deceive job seekers and digital marketing professionals to deliver a previously undocumented malware called Vampire Bot. "The attackers pose as recruiters, distributing...
EUVD-2014-3448
Malware in sbrugna...
EUVD-2021-16636
Malware in sbrugna...
EUVD-2020-5032
Malware in sbrugna...
EUVD-2020-9349
Malware in sbrugna...
EUVD-2015-2673
Malware in sbrugna...
EUVD-2014-2510
Malware in sbrugna...
EUVD-2002-0842
Malware in sbrugna...
EUVD-2006-5378
Malware in sbrugna...