Mcpgateway
Monthly
Command injection in MCPGateway's Claude Usage Range Endpoint allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `since` date argument passed to `getUsageByDateRange` in `src/services/claude-usage.ts`. All versions up to commit 549f494a9e363f40530149de324b8097de424230 are affected, with a proof-of-concept exploit publicly available via the project's GitHub issue tracker. No patch has been released; the maintainer has not responded to the coordinated disclosure despite early notification, leaving deployments with no vendor-supported remediation path.
Command injection in MCPGateway's Claude Usage Range Endpoint allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `since` date argument passed to `getUsageByDateRange` in `src/services/claude-usage.ts`. All versions up to commit 549f494a9e363f40530149de324b8097de424230 are affected, with a proof-of-concept exploit publicly available via the project's GitHub issue tracker. No patch has been released; the maintainer has not responded to the coordinated disclosure despite early notification, leaving deployments with no vendor-supported remediation path.