CVE-2026-52618

CVE-2026-52618 affects the @webfer/mcp-ansible-drupal npm package (version 2.0.0 ). The root cause is spawn(cmd[0], cmd.slice(1), { shell: true }) in runAnsible.ts, which re-joins an argument array into a single /bin/sh -c string without escaping. An attacker who controls the extraVars value pass...