MCP Watch 操作系统命令注入漏洞

MCP Watch is a comprehensive security scanning program for Model Context Protocol servers by the individual developer Kapil Duraphe. An operating system command injection vulnerability exists in MCP Watch version 0.1.2 and earlier, which stems from command injection and could lead to arbitrary...

CVE-2025-35028 HexStrike AI MCP Server Command Injection

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...

CVE-2025-35028 HexStrike AI MCP Server Command Injection

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...

CVE-2025-35028

HexStrike AI MCP Server is affected by a command-injection vulnerability in the EnhancedCommandExecutor API endpoint. A command-line argument starting with a semicolon (;) can cause a composed command to run with the MCP server’s privileges (typically root) because default configurations do not s...

CVE-2025-35028 HexStrike AI MCP Server Command Injection

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...

PT-2025-48532

🚨 CVE-2026-1442 Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker or anyone paying attention, the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 a...

CVE-2025-35028: Improper Neutralization of Special Elements used in an OS Command

By providing a command-line argument starting with a semi-colon ; to an API endpoint created by the EnhancedCommandExecutor class of the HexStrike AI MCP server, the resultant composed command is executed directly in the context of the MCP server’s normal privilege; typically, this is root. There...

PT-2025-48397

Name of the Vulnerable Software and Affected Versions HexStrike AI MCP Server versions prior to commit 2f3a5512 Description The HexStrike AI MCP Server is susceptible to a command injection issue. By supplying a command-line argument beginning with a semicolon ; to an API endpoint created by the...

HexStrike AI MCP Agents 安全漏洞

HexStrike AI MCP Agents is an MCP server by the individual developer Muhammad Osama. HexStrike AI MCP Agents suffers from a security vulnerability that stems from not cleaning up command line parameters, which could lead to the execution of arbitrary code...

EUVD-2025-199592

Malicious code in mcp-polymarket npm...

Malicious Package

Overview mcp-polymarket is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in mcp-polymarket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c93eadc60da9cb188762b7190a7c6b48a5eaa9766f23d7515b944c05eb3f005 The package mcp-polymarket was found to contain malicious code. Source: ghsa-malware 41eb8c2fd8bee675d7893ba16ddd2f6fd03730818520e928c0320ed2a0306602...

EUVD-2025-199507

Malicious code in @browserbasehq/mcp-server-browserbase npm...

MAL-2025-191196 Malicious code in @browserbasehq/mcp-server-browserbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c07fb8ebd39670ff0a8c67a71dc45872c40e94a70a4100940576791f12cd66 The package @browserbasehq/mcp-server-browserbase was found to contain malicious code. Source: google-open-source-security...

EUVD-2025-199336

Malicious code in @browserbasehq/mcp npm...

MAL-2025-191195 Malicious code in @browserbasehq/mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd1d0d39e38fcabc19d825aaf056705056728c59701b5fe8cdf5863839a072b3 The package @browserbasehq/mcp was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199140

Malicious code in @seezo/sdr-mcp-server npm...

EUVD-2025-199143

Malicious code in @relyt/mcp-server-relytone npm...

MAL-2025-191051 Malicious code in @relyt/claude-context-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7128c912d51fd365b62035c31a922a12b13bbc16e66c119bc931281f60d29922 The package @relyt/claude-context-mcp was found to contain malicious code. Source: ghsa-malware...

Malicious code in @relyt/claude-context-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7128c912d51fd365b62035c31a922a12b13bbc16e66c119bc931281f60d29922 The package @relyt/claude-context-mcp was found to contain malicious code. Source: ghsa-malware...