Description
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.
Published: 2026-08-06
Score: 5.3 Medium
EPSS: 1.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the mcp-api NPM package version handler, specifically in the this.packageService.installPackage function, which improperly incorporates input into system commands. This flaw allows a remote attacker to inject arbitrary commands, potentially affecting confidentiality, integrity and availability of the host system. The weakness is characterized by code reviews of CWE-74 and CWE-77.

Affected Systems

MissionSquad mcp-api versions 1.11.8 and earlier are impacted. Users of the NPM package version handler that invoke installPackage without sanitizing input are at risk. The issue is fixed in v1.11.9 released by MissionSquad.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity. With an EPSS score of 2% and absence from the CISA KEV catalog, the likelihood of exploitation appears limited; however, the attack vector is remote and does not require special privileges. An attacker can trigger the faulty command handling by supplying malicious input through the exposed API, leading to arbitrary system command execution if the application runs with elevated privileges.

Generated by OpenCVE AI on August 7, 2026 at 14:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MissionSquad mcp-api to version 1.11.9 or later.
  • Refactor the installPackage logic to escape or whitelist allowed characters before constructing shell commands.
  • Implement input validation to ensure package identifiers or parameters are strictly validated against expected patterns.

Generated by OpenCVE AI on August 7, 2026 at 14:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.
Title MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
First Time appeared Missionsquad
Missionsquad mcp-api
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:missionsquad:mcp-api:*:*:*:*:*:*:*:*
Vendors & Products Missionsquad
Missionsquad mcp-api
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Missionsquad Mcp-api
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-06T17:31:30.989Z

Reserved: 2026-08-06T06:01:47.080Z

Link: CVE-2026-19041

cve-icon Vulnrichment

Updated: 2026-08-06T17:23:23.194Z

cve-icon NVD

Status : Deferred

Published: 2026-08-06T14:16:36.223

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-19041

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T14:45:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')