Mcp Bridge Api
Monthly
Command injection in INQUIRELAB mcp-bridge-api's Servers Endpoint allows unauthenticated remote attackers to execute arbitrary OS commands by manipulating the command/args parameters in mcp-bridge.js without sanitization. The product uses a rolling release model and all commits up to b30a82aa1d1d1139e0de846c41c8aadee6e06114 are confirmed affected. No released patch exists - a remediation pull request has been submitted but was awaiting acceptance at time of disclosure. No public exploit or KEV listing identified at time of analysis.
Command injection in INQUIRELAB mcp-bridge-api's Servers Endpoint allows unauthenticated remote attackers to execute arbitrary OS commands by manipulating the command/args parameters in mcp-bridge.js without sanitization. The product uses a rolling release model and all commits up to b30a82aa1d1d1139e0de846c41c8aadee6e06114 are confirmed affected. No released patch exists - a remediation pull request has been submitted but was awaiting acceptance at time of disclosure. No public exploit or KEV listing identified at time of analysis.