EUVD-2026-63326
GHSA-cmg9-62q9-xmww
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Full command execution gives C/I/A:H with no auth on the MCP tool (PR:N), but exploitation depends on inducing an AI agent to call the tool, warranting AC:H.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
6DescriptionCVE.org
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities.
AnalysisAI
Arbitrary OS command execution in Neo.mjs (versions prior to commit 88c77fc4) arises in the ai/mcp/server/file-system MCP server, whose FileSystemService.mjs passes a caller-supplied absolutePath into a shell via exec() inside checkSyntax() and runPlaywrightTest(). An attacker who can steer an AI agent into calling these MCP tools with a path containing shell metacharacters runs commands with the privileges of the MCP server process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a deployment of Neo.mjs prior to commit 88c77fc4 that runs the ai/mcp/server/file-system MCP server and exposes its checkSyntax() and/or runPlaywrightTest() tools to an AI agent. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) treats this as trivially remote and unauthenticated, but the description qualifies exploitation as occurring 'when an AI agent is induced to invoke these tools' - an indirection that in practice raises attack complexity and often narrows the real vector to a locally-run MCP server, so the raw 9.8 likely overstates unconditional network exposure; verify deployment topology with the operator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - update Neo.mjs to a build that includes commit 88c77fc4 (and 5acc564ea1b278bca5fab1f8f397a6ba9b849d75), which replaces exec() with execFile() and hardens the path sandbox; track the corresponding tagged npm release before pinning in production. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Neo.mjs and determine which integrate with AI agents or MCP file-system servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today