mcp-ripgrep EUVD-2026-104861

Requires the mcollina mcp-ripgrep MCP server (versions up to 0.4.0) to be deployed, and the attacker must be able to control the fileType argument of the Advanced Search Tool in src/index.ts - the one argument NOT run through the project's escapeShellArg routine (sibling arguments are escaped), which is the specific CWE-78 oversight. Exploitation is strictly local (AV:L) with no remote path, and needs low-privilege access (PR:L) sufficient to invoke the search tool; no user interaction is required. LIMITING FACTORS: no network vector, injected commands run only with the privileges of the user already running the MCP server/ripgrep (the basis of the maintainer's dispute that this is expected 'runs commands on your machine' behavior), and realistic risk hinges on whether untrusted input can actually reach the fileType parameter in a given deployment.

Signals are mostly consistent toward a LOW-to-MODERATE real-world priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 4.8 (medium): exploitation is local, not network-facing, and requires low-privilege access (PR:L) sufficient to invoke the Advanced Search Tool and control its fileType argument. POC/exploit code is publicly available (gist), and the CVSS carries E:P (Proof-of-Concept maturity) - but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score was provided in the input, so widespread or automated exploitation is unsubstantiated. A notable conflict exists between sources: VulDB records that 'the real existence of this vulnerability is still doubted,' and the maintainer documents the shell-execution behavior as an expected caution ('it runs commands on your machine'), yet the supplied technical analysis shows fileType is the one argument skipped by the project's own escapeShellArg routine - indicating a genuine CWE-78 oversight rather than fully documented design. Net: a real but bounded local command-injection issue whose practical impact depends on whether untrusted input (e.g., via prompt injection or malicious data feeding the MCP tool) can reach the fileType parameter; it is not a drop-everything priority absent network exploitability or confirmed in-the-wild use.

An actor able to supply input to the mcp-ripgrep Advanced Search Tool (for example through a prompt-injection or malicious-document path that controls the fileType parameter) embeds shell metacharacters that are not passed through escapeShellArg, causing ripgrep to be invoked with attacker-chosen OS commands. A public proof-of-concept exists (gist by sandh0t). Exploitation is local and low-complexity but requires the ability to invoke the tool, and executes with the privileges of the user running the MCP server.