@elgentos/magento2-dev-mcp vulnerable to command injection

Description

A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.2

References

• GHSA-xqv9-qr76-hfq2
• vuldb.com
• CVE-2026-5603
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes - CVE-2026-31861
• orval MCP client is vulnerable to a code injection attack. - CVE-2026-22785
• mcp-package-docs vulnerable to command injection in several tools - CVE-2025-54073
• lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@elgentos/magento2-dev-mcp