Command injection in Kirachon context-engine up to version 1.9.0 allows adjacent authenticated attackers to execute arbitrary OS commands through the review-git-diff MCP endpoint. The root cause is the execGitCommand function in src/mcp/utils/gitUtils.ts passing user-supplied git reference arguments - branch names, commit hashes, and path patterns - directly to a shell-invoked subprocess without sanitization, enabling shell metacharacter injection. No public exploit has been independently distributed, though the patch commit itself embeds proof-of-concept test cases confirming the injection vector; version 1.9.1 resolves the issue.
Command injection in MIMICLab mcp-pdf-vision 1.1.0 allows a local low-privileged attacker to execute arbitrary OS commands by supplying crafted values to the pdfPath or sessionId arguments of the load_pdf function in src/index.ts. The CVSS 4.0 score of 4.8 (Medium) reflects a local-only attack surface with limited confidentiality, integrity, and availability impact; no scope change to subsequent systems is possible. A proof-of-concept exists per the E:P exploit maturity indicator in the CVSS 4.0 vector, and no patch has been released - the vendor has not responded to the responsible disclosure filed via GitHub issue.
Command injection in slidev-builder-mcp 2.1.0 allows local low-privilege users to execute arbitrary OS commands by passing shell metacharacters in the `outputDir` argument to the `generateChart` function of the generateAssets Tool. The attack is confined to local access only (CVSS 4.0 AV:L), and the CVSS 4.0 E:P modifier confirms publicly available proof-of-concept code exists. No vendor patch has been released as the project has not responded to the disclosure; no confirmed active exploitation (not in CISA KEV) has been identified at time of analysis.
Command injection in MauricioMilano coder-api (all versions through 1.1.0) allows a local, low-privileged attacker to execute arbitrary OS commands via the createProject function in the Projects Endpoint. The vulnerability stems from unsanitized input passed to a system command in src/core/projects.ts, enabling an attacker with local access to manipulate project creation inputs and achieve code execution in the application's runtime context. A proof-of-concept exploit exists (CVSS 4.0 E:P), no patch has been released, and the project maintainer has not responded to the responsible disclosure report.
Command injection in andreahaku llm_memory_mcp allows local attackers with limited privileges to execute arbitrary OS commands by manipulating the `hash` argument passed to the `auto.capture` function in `GitHooksManager.ts`. All commits up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0 are affected, and a proof-of-concept is indicated as available via the CVSS 4.0 E:P enrichment. No patch has been released, and the project maintainer has not responded to the coordinated disclosure reported via GitHub issue.
Path traversal in abrinsmead mindpilot-mcp 0.5.0 allows local low-privileged users to escape intended directory boundaries by supplying crafted path traversal sequences as the ID argument to the HistoryService component, enabling unauthorized file reads and writes within the process's permission scope. Publicly available proof-of-concept exploit code exists (E:P per CVSS 4.0 vector), and the vendor has not responded to coordinated disclosure via GitHub issue #24. No patch is available at time of analysis.
Path traversal in astralisone's rive-mcp-server-core MCP server allows local low-privileged users to escape the intended directory boundary by supplying crafted sequences in the `libraryId` argument of the importRiveFile flow, enabling unauthorized read and partial write access to files on the host system. All commits up to db1d0cc4cd52589116360428b7504fd0ca748b3e of the rolling-release project are affected, with no vendor patch issued and no vendor response to disclosure at time of analysis. A proof-of-concept exploit exists (CVSS 4.0 E:P), though no confirmed active exploitation (CISA KEV) has been reported.
Path traversal in aaronsb memory-graph affects three JsonMemoryStorage functions - createDomain, getMemories, and saveMemories - in src/tools/memoryTools.ts, enabling local low-privilege attackers to escape the intended storage directory and read or write arbitrary files accessible to the process. All rolling-release versions through commit 5cfd238 are affected with no vendor patch issued; the project was notified via GitHub issue #14 but has not responded. A proof-of-concept exploit is publicly available (CVSS 4.0 E:P), and no confirmed active exploitation is listed in CISA KEV.
Path traversal in Hulupeep mcp-ui-probe 0.1-0.2.0 allows a local authenticated user to read, write, or delete arbitrary files by manipulating the journeyId or filename arguments passed to the Journey and Usage API functions in JourneyStorage.ts. The CVSS 4.0 E:P supplemental metric confirms publicly available proof-of-concept exploit code exists, raising real-world risk above what the moderate base score alone suggests. No vendor patch is available; the project has not responded to the responsible disclosure submitted via GitHub issue.
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path doesn't use nested_vmx_vmexit() as that API is intended to be used if and only if L2 is active, and the open coded equivalent neglects to put the vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages (and/or mappings) if L1 retries VMLAUNCH/VMRESUME. Note, the !from_vmenter scenario doesn't suffer the same problem, as vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry getting vmcs12 pages.