MCP, MCP server
Mcp Cve Project
This repository is a curated index of publicly disclosed Common Vulnerabilities and Exposures (CVEs) that touch the Model Context Protocol (MCP) ecosystem: official and third-party servers, SDKs, gateways, clients, and integrations where MCP is part of the attack surface
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_SHELL_UNDECLARED
Why this grade
- PERMISSION_SHELL_UNDECLARED Medium
Runs shell commands that the manifest or description does not mention.
README.md, line 366
| 79 | 2025‑07‑21 | [CVE‑2025‑53832](cves/CVE-2025-53832.md) | MCP05 - Command Injection & Execution | Lara Translate MCP Server (`@translated/lara-mcp`) (
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
requests shell access. No manifest field names shell or command execution.
PERMISSION_SHELL_UNDECLARED
README.md, line 366
| 79 | 2025‑07‑21 | [CVE‑2025‑53832](cves/CVE-2025-53832.md) | MCP05 - Command Injection & Execution | Lara Translate MCP Server (`@translated/lara-mcp`) (
cves/CVE-2025-52573.md, line 15
| Component | MCP tools (`ui_tap` and related) using `child_process.exec` |
cves/CVE-2025-52573.md, line 30
iOS Simulator MCP Server versions prior to **1.3.3** build shell commands with Node.js `child_process.exec` using LLM-controlled tool arguments. Inputs such as `duration`, `udid`,
Show more
cves/CVE-2025-53107.md, line 37
Unsanitized parameters passed to `child_process.exec`
cves/CVE-2025-53832.md, line 9
| Affected product (index) | Lara Translate MCP Server (`@translated/lara-mcp`) (npm) - command injection / RCE via `child_process.exec` |
cves/CVE-2025-53832.md, line 26
Command injection in the Lara Translate MCP Server: user-influenced input used in command-line construction is passed to Node.js `child_process.exec`, so shell metacharacters can y
cves/CVE-2025-54994.md, line 27
The package’s MCP server implementation exposes a tool that uses `child_process.exec` in an unsafe way, allowing command injection when untrusted input reaches the affected code pa
cves/CVE-2025-58358.md, line 30
Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caused by the unsanitized
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
cves/CVE-2026-19751.md, line 31
A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of
cves/CVE-2026-55557.md, line 29
browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, filename) wit
cves/CVE-2026-77249.md, line 26
The earlier SSRF remediation attached redirect validation to the normal Jira HTTP session, but a user-permission lookup used the module-level `requests.get`. Redirects on that path
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
cves/CVE-2025-61260.md, line 27
A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is
cves/CVE-2026-12537.md, line 31
Improper neutralization in the Gemini CLI container launcher (headless/CI) allows pre-sandbox host-level code execution via a malicious `.gemini/.env` file. Relevant to MCP-shaped
cves/CVE-2026-27203.md, line 30
eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable In
Show more
cves/CVE-2026-47394.md, line 31
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulne
cves/CVE-2026-66065.md, line 31
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incompl
cves/CVE-2026-73498.md, line 41
Tool scope implied Confluence uploads; actual reach is host filesystem read - enabling exfiltration of `CONFLUENCE_API_TOKEN`, `.env`, SSH keys, and other secrets visible to the MC
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
the file cap was reached before every file was read.
OBFUSCATION_FILE_CAP_REACHED
cves/CVE-2026-55637.md, line 1
# CVE-2026-55637 | genieacs-mcp Streamable HTTP DNS rebinding | High | 8.8
Licence
Note
no licence file found.
LICENCE_MISSING
No file path was stored.
no licence file found.
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit b9c5123c8b1d. requests shell access. No manifest field names shell or command execution. can reach a host that is not written as a fixed address. reads a credential or environment file. the file cap was reached before every file was read. no licence file found.
Date and source
Date checked:
github.com
Commit graded: b9c5123c8b1d1fabae4482ceec6dbdf953a6d4f2
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.