EUVD-2026-53927
GHSA-pcgr-7p2p-x7w8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege API credentials
-
DeliverySend HTTP install request with injected version string
-
Exploitexec() passes command to shell interpreter
-
ExecutionShell metacharacters split and execute injected payload
-
ImpactArbitrary OS commands run as mcp-api service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires low-privilege authenticated access to the mcp-api HTTP API (PR:L per CVSS 4.0 vector). The specific trigger is a malicious value in the version parameter of the NPM package installation request handled by |
| Impact | The CVSS 4.0 base score of 5.3 (Medium) is consistent with the attack profile: network-reachable, low complexity, but gated behind low-privilege authentication (PR:L), with impact confined to the vulnerable system (SC:N/SI:N/SA:N). The E:P supplemental metric confirms proof-of-concept exploit code exists, which meaningfully raises the practical exploitability above the base score alone implies. CISA KEV status is negative - no confirmed mass exploitation - suggesting opportunistic or targeted rather than widespread abuse. The 'Low' impact ratings (VC:L/VI:L/VA:L) may understate real-world consequences: command injection that achieves arbitrary OS code execution as the service account can escalate to full host compromise depending on runtime privilege configuration and container/VM isolation. EPSS data was not provided in the input; risk should be treated as elevated for any internet-exposed deployment. No conflicting signals between data sources were identified. |
| Exploit ScenarioDerived | An authenticated user sends an HTTP request to the mcp-api package installation endpoint with a version parameter containing shell metacharacters, such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Command injection in MissionSquad mcp-api through version 1.11.8 enables remote authenticated users to execute arbitrary OS-level commands on the host by supplying a crafted version string to the NPM package installation endpoint. The root cause is string interpolation of unvalidated user input into a Node.js exec() call, which passes the resulting string through a shell interpreter - making shell metacharacters in the version parameter an effective injection vector. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no active exploitation has been confirmed by CISA KEV. A patched release (v1.11.9) is available.
RemediationAI
Upgrade MissionSquad mcp-api to version 1.11.9, the vendor-released patch confirmed at https://github.com/MissionSquad/mcp-api/releases/tag/v1.11.9. The fix (commit a40f54d4533ba6618e1749383a245900eeb024c1, PR #44) replaces the shell-based exec() invocation with execFile() using shell: false, directly invoking node + npm-cli.js when the CLI path is resolvable, and adds strict allowlist regex validation for both package name and version fields. If immediate upgrade is not feasible, a compensating control is to restrict network access to the package installation endpoint (e.g., behind an authenticated API gateway or firewall rule) to reduce the attack surface; however, this does not eliminate the injection flaw and should be treated as temporary. Disabling the NPM package management feature entirely until the patch is applied is the most reliable mitigation if the feature is not operationally required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mcp-api is a Node.js/TypeScript REST API server used to manage MCP (Model Context Protocol) server configurations, including dynamic installation of NPM packages. The vulnerable code in src/services/packages.ts constructed npm install commands via template-literal string interpolation - npm install ${name}${version ? '@' + version : ''} - and executed them using Node.js child_process.exec(). Because exec() passes the full command string through a shell interpreter (/bin/sh on Unix, cmd.exe on Windows), any shell metacharacter in the version argument (e.g., ;, &&, |, backticks) is interpreted and executed. While a basic allowlist regex existed for the package name field, the version parameter had no validation whatsoever in the affected releases, providing the primary injection path. The fix (commit a40f54d) replaces exec() with execFile() (shell-bypass mode), adds a strict allowlist regex for both name and version fields, and implements a helper runNpm() that resolves npm's CLI path directly to avoid shell invocation entirely. CWE-77 (Improper Neutralization of Special Elements used in a Command) precisely characterizes this root cause.
Know when Mcp Api gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable endpoint requires low-privilege authentication (PR:L); no scope change as subsequent-system impact is absent per CVSS 4.0 SC/SI/SA:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB