Description
A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.0.2
References
Could your website be exposed too?
SmartScanner can check your website for @elgentos/magento2-dev-mcp vulnerable to command injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes - CVE-2026-31861
- orval MCP client is vulnerable to a code injection attack. - CVE-2026-22785
- mcp-package-docs vulnerable to command injection in several tools - CVE-2025-54073
- lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800
You might also like:
See something that needs correcting? Let us knowUpdated April 06, 2026