PT-2026-68495 · Npm · Mcp-Api
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
MissionSquad mcp-api versions prior to 1.11.9
Description
Command injection is possible via remote attack in the NPM Package Version Handler component. The issue resides in the
this.packageService.installPackage() function within the src/controllers/packages.ts file.Recommendations
Upgrade to version 1.11.9.
Exploit
Fix
Special Elements Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mcp-Api