Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection
Vulnerability Description
A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor explains: "The usual use case is that AI is asked to do something, picks commands itself, and typically uses simple command names without absolute paths. It's curious why a user would ask the model to bypass restrictions this way. (...) This could potentially be a problem, but we are yet to hear reports of this being an issue in actual workflows. We'll leave this issue open for situations where people may report this as a problem for the long term."
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
Desktop Commander MCP 安全漏洞
Vulnerability Description
Desktop Commander MCP是Eduard Ruzga个人开发者的一个MCP服务器。 Desktop Commander MCP 0.2.13及之前版本存在安全漏洞，该漏洞源于Absolute Path Handler组件中src/command-manager.ts文件的extractBaseCommand函数存在os命令注入，可能被远程利用。
CVSS Information
N/A
Vulnerability Type
N/A