Supabase Mcp
Monthly
Command injection in NightTrek Supabase-MCP's `generate_types` component exposes systems to arbitrary OS command execution via unsanitized `schema` argument input. Exploitation is restricted to local, low-privileged attackers who can invoke the affected MCP tool - significantly constraining real-world impact. The CVSS 4.0 score of 1.9 reflects these narrow conditions; however, a proof-of-concept is indicated by the E:P modifier in the provided vector. No vendor patch exists and the maintainer has not responded to the responsible disclosure issue filed on GitHub.
Command injection in NightTrek Supabase-MCP's `generate_types` component exposes systems to arbitrary OS command execution via unsanitized `schema` argument input. Exploitation is restricted to local, low-privileged attackers who can invoke the affected MCP tool - significantly constraining real-world impact. The CVSS 4.0 score of 1.9 reflects these narrow conditions; however, a proof-of-concept is indicated by the E:P modifier in the provided vector. No vendor patch exists and the maintainer has not responded to the responsible disclosure issue filed on GitHub.