CVE-2026-7061

Name of the Vulnerable Software and Affected Versions chatgpt-mcp-server versions prior to 0.1.1

Description An OS command injection flaw exists in the MCP/HTTP component within the src/services/docker.service.ts file. This issue allows unauthenticated remote attackers to achieve remote code execution via the Docker service component, which is designed to bridge Model Context Protocol (MCP) servers with Docker containers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the src/services/docker.service.ts component to minimize the risk of exploitation.