Supabase-MCP CVE-2026-19333

Q: What is the CVSS score of CVE-2026-19333?

CVE-2026-19333 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

Q: Which versions of Supabase-MCP are affected by CVE-2026-19333?

Command injection in NightTrek Supabase-MCP's `generate_types` component exposes systems to arbitrary OS command execution via unsanitized `schema` argument input.

EUVD-2026-54870 LOW

Command Injection (CWE-77)

2026-08-09 VulDB

GHSA-xw8f-8xpv-55vg

Command Injection Supabase Mcp

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Local-only vector (AV:L) and low OS privileges (PR:L) match description; limited CIA impact with no scope change reflects narrow MCP process context.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 09, 2026 - 05:28 vuln.today

Severity Changed

Aug 09, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

Aug 09, 2026 - 05:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

DescriptionCVE.org

A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issue is some unknown functionality of the component generate_types. The manipulation of the argument schema results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Command injection in NightTrek Supabase-MCP's generate_types component exposes systems to arbitrary OS command execution via unsanitized schema argument input. Exploitation is restricted to local, low-privileged attackers who can invoke the affected MCP tool - significantly constraining real-world impact. The CVSS 4.0 score of 1.9 reflects these narrow conditions; however, a proof-of-concept is indicated by the E:P modifier in the provided vector. No vendor patch exists and the maintainer has not responded to the responsible disclosure issue filed on GitHub.

Technical ContextAI

NightTrek Supabase-MCP is a Model Context Protocol (MCP) server that allows AI assistants (such as Claude) to interact with Supabase PostgreSQL databases programmatically. The generate_types function, which likely invokes an external CLI tool (such as the Supabase CLI or pg_dump-style commands) to derive TypeScript types from a database schema, accepts a schema parameter. Per CWE-77 (Improper Neutralization of Special Elements Used in a Command), this input is passed directly into a shell command without sanitization or parameterization, enabling injection of shell metacharacters. The CPE cpe:2.3:a:nighttrek:supabase-mcp:*:*:*:*:*:*:*:* with wildcard versioning confirms no fixed release has been identified; specific vulnerable commits are cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170 and db03237d92f7dc2f0da0d70a87dba84ebcde5b66.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project was notified through a GitHub issue report but the maintainer has not responded. The primary compensating control is to restrict local OS access to the host running Supabase-MCP to trusted users only, eliminating the local low-privileged attacker prerequisite entirely; the trade-off is administrative overhead in multi-user environments. Alternatively, disable the generate_types MCP tool in your MCP server configuration if TypeScript type generation is not required - this surgically removes the vulnerable code path with no impact on other Supabase-MCP functionality. If the integration is not operationally essential, remove Supabase-MCP from the AI assistant's MCP server list entirely until a patched release is available. Monitor https://github.com/NightTrek/Supabase-MCP/issues/2 and https://github.com/NightTrek/Supabase-MCP/ for any upstream fix. Organizations should review whether community-maintained MCP integrations without active maintainers meet their security posture requirements.