Description
A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search. Performing a manipulation of the argument SearchResult[] results in inefficient regular expression complexity. It is possible to initiate the attack remotely.
Recommendation
Update the @wonderwhy-er/desktop-commander package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.2.39
- Patched version(s): 0.2.39
References
Could your website be exposed too?
SmartScanner can check your website for DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption and gives you actionable findings to investigate.
Start a free scanRelated Issues
- DesktopCommanderMCP is vulnerable to SSRF - CVE-2026-10690
- @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue - CVE-2026-8769
- Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity - CVE-2025-58451
- @isaacs/brace-expansion has Uncontrolled Resource Consumption - CVE-2026-25547
You might also like:
See something that needs correcting? Let us knowUpdated July 10, 2026