{"id":"CVE-2026-25546","aliases":["GHSA-8jx2-rhfh-q928"],"url":"https://o3.security/vulnerability/CVE-2026-25546","summary":"Godot MCP is vulnerable to Command Injection via unsanitized projectPath","details":"### Impact \nA Command Injection vulnerability in godot-mcp allows remote code execution. The `executeOperation` function passed user-controlled input (e.g., `projectPath`) directly to `exec()`, which spawns a shell. An attacker could inject shell metacharacters like `$(command)` or `&calc` to execute arbitrary commands with the privileges of the MCP server process. \n\nThis affects any tool that accepts `projectPath`, including `create_scene`, `add_node`, `load_sprite`, and others. \n\n### Patches \nFixed in version 0.1.1 by switching from `exec()` to `execFile()`, which does not invoke a shell. \n\n### Workarounds \nNone. Users should upgrade immediately. \n\n### Resources\n - https://github.com/Coding-Solo/godot-mcp/issues/64\n - https://github.com/Coding-Solo/godot-mcp/pull/67","published":"2026-02-04T21:48:53.225Z","modified":"2026-08-12T03:51:14.249364962Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@coding-solo/godot-mcp","fixedVersion":"0.1.1"}],"fix":{"url":"https://github.com/Coding-Solo/godot-mcp/commit/21c785d923cfdb471ea60323c13807d62dfecc5a","label":"Coding-Solo/godot-mcp@21c785d"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25546.json"},{"type":"ADVISORY","url":"https://github.com/Coding-Solo/godot-mcp/security/advisories/GHSA-8jx2-rhfh-q928"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25546"},{"type":"REPORT","url":"https://github.com/Coding-Solo/godot-mcp/issues/64"},{"type":"FIX","url":"https://github.com/Coding-Solo/godot-mcp/commit/21c785d923cfdb471ea60323c13807d62dfecc5a"},{"type":"FIX","url":"https://github.com/Coding-Solo/godot-mcp/pull/67"},{"type":"PACKAGE","url":"https://github.com/Coding-Solo/godot-mcp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:14.249364962Z"}}