Description
A command injection vulnerability exists in the mcp-package-docs MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process’s privileges.
Recommendation
Update the mcp-package-docs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.1.27
- Patched version(s): 0.1.28
References
Could your website be exposed too?
SmartScanner can check your website for mcp-package-docs vulnerable to command injection in several tools and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @elgentos/magento2-dev-mcp vulnerable to command injection - CVE-2026-5603
- Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools - CVE-2025-9611
- MCPHub's ServerController is vulnerable to Command Injection - CVE-2025-11285
- MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server - CVE-2025-58444
You might also like:
See something that needs correcting? Let us knowUpdated August 05, 2025