CVE-2026-25546

Katalog CVE

CVSS 7.8 · High EPSS 1,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada coding-solo godot mcp. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input (e.g., projectPath) directly to exec(), which spawns a shell. An attacker could inject shell metacharacters like $(command) or &calc to execute arbitrary commands with the privileges of the MCP server process. This affects any tool that accepts projectPath, including create_scene, add_node, load_sprite, and others. This issue has been patched in version 0.1.1.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Coding-Solo/godot-mcp/security/advisories/GHSA-8jx2-rhfh-q928 advisory vendor
• https://github.com/Coding-Solo/godot-mcp/commit/21c785d923cfdb471ea60323c13807d62dfecc5a patch
• https://github.com/Coding-Solo/godot-mcp/pull/67 issue tracking · patch
• https://github.com/Coding-Solo/godot-mcp/issues/64 issue tracking