EUVD-2026-53934
GHSA-rjcp-8q3w-gjhq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector with low-privilege MCP access required; unchanged scope and limited C/I/A impact matching CVSS 4.0 base metrics.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in LeeSinLiang's godot-mcp 0.1.0 allows local low-privileged users to execute arbitrary OS commands by supplying a crafted projectPath argument to the executeOperation function in src/index.ts, specifically through the create_scene and add_node MCP operation handlers. This Model Context Protocol server for the Godot game engine was disclosed via a GitHub issue report that the project maintainer has not yet addressed. No active exploitation has been confirmed and no CISA KEV listing exists, though the CVSS 4.0 temporal metric E:P confirms publicly available proof-of-concept exploit code.
Technical ContextAI
godot-mcp is a Model Context Protocol (MCP) server that bridges AI assistant clients (such as Claude or similar LLM-based tools) with the Godot game engine, enabling AI-driven scene creation, node manipulation, and other editor operations. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command): the executeOperation function in src/index.ts accepts a projectPath argument from MCP operation calls and passes it unsanitized to an underlying shell command, allowing injection of arbitrary shell metacharacters. The affected CPE is cpe:2.3:a:leesinliang:godot-mcp:*:*:*:*:*:*:*:*, with version 0.1.0 confirmed by EUVD-2026-53934. The wildcard CPE notation suggests the flaw may not be version-scoped.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the GitHub disclosure at https://github.com/LeeSinLiang/godot-mcp/issues/1. Developers should discontinue use of godot-mcp 0.1.0 in shared or multi-user environments until a fix is released. As a compensating control, restrict MCP server access to fully trusted local users only, preventing untrusted principals from invoking create_scene or add_node operations with attacker-controlled projectPath values. Sanitize or reject projectPath inputs containing shell metacharacters (semicolons, pipes, backticks, dollar signs, ampersands) at the application boundary. Monitor the repository at https://github.com/LeeSinLiang/godot-mcp for patch releases. Note that input validation alone is insufficient without a code-level fix; developers comfortable modifying the codebase should replace shell interpolation with a safe command execution API that passes arguments as discrete array elements rather than a composed shell string.
Remote code execution in Godot MCP prior to version 0.1.1 results from unsafe shell command execution when processing us
Path traversal in tugcantopaloglu godot-mcp 2.0.0 allows a local low-privileged user to escape the intended project dire
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today