Description
A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The name of the patch is aa1ffcc0aea1b212c69787391783af27df15ae9d. A patch should be applied to remediate this issue.
Published: 2026-04-05
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Command Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the executeMagerun2Command function within the elgentos magento2-dev-mcp package, allowing local attackers to inject arbitrary operating‑system commands. This flaw permits execution of commands on the system where the component runs, potentially compromising confidentiality, integrity, and availability of that environment. The weakness is categorized as OS Command Injection (CWE-77, CWE-78).

Affected Systems

The affected product is elgentos magento2-dev-mcp, with all releases up to and including version 1.0.2 vulnerable. No other vendors or products are listed as impacted.

Risk and Exploitability

The CVSS base score is 4.8, which places the vulnerability in the Low severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access, as stated by the vendor, and a public exploit is available. While remote exploitation is not feasible, the presence of a local command‑injection vector remains a concern for systems that allow local users to invoke the component.

Generated by OpenCVE AI on April 6, 2026 at 01:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch identified by commit aa1ffcc0aea1b212c69787391783af27df15ae9d or upgrade elgentos magento2-dev-mcp to a version newer than 1.0.2.
  • Verify that the executeMagerun2Command function no longer accepts untrusted input after the update or patch.
  • Restrict local access to the system running the component so that only trusted users can invoke it.
  • Conduct a security scan or code review to ensure no other command‑injection paths remain.

Generated by OpenCVE AI on April 6, 2026 at 01:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xqv9-qr76-hfq2 @elgentos/magento2-dev-mcp vulnerable to command injection
History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Elgentos
Elgentos magento2-dev-mcp
Vendors & Products Elgentos
Elgentos magento2-dev-mcp

Mon, 06 Apr 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Apr 2026 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The name of the patch is aa1ffcc0aea1b212c69787391783af27df15ae9d. A patch should be applied to remediate this issue.
Title elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Elgentos Magento2-dev-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T14:50:10.379Z

Reserved: 2026-04-05T13:58:08.432Z

Link: CVE-2026-5603

cve-icon Vulnrichment

Updated: 2026-04-06T14:33:53.773Z

cve-icon NVD

Status : Deferred

Published: 2026-04-05T23:16:20.390

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-5603

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:48:05Z

Weaknesses