PT-2026-23889 · Ryuzakishinji · Biome-Mcp-Server

Yinci Chen · Publicado 2026-03-07 · Atualizado 2026-03-08 · CVE-2026-3680

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RyuzakiShinji biome-mcp-server versions up to 1.0.0

Description A security flaw exists in RyuzakiShinji biome-mcp-server up to version 1.0.0, related to an unknown functionality within the biome-mcp-server.ts file. A manipulation of this functionality can lead to command injection, and the attack can be initiated remotely. The exploit has been publicly released.

Recommendations Apply patch 335e1727147efeef011f1ff8b05dd751d8a660be.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2026-3680

Produtos afetados

Biome-Mcp-Server

Referências · 11

• 🔥❌ https://github.com/user-attachments/files/25466715/biome-mcp-server_security_advisory.pdf · Exploit, Deleted
• https://github.com/RyuzakiShinji/biome-mcp-server/pull/1 · Correção
• https://github.com/RyuzakiShinji/biome-mcp-server/pull/1/changes/335e1727147efeef011f1ff8b05dd751d8a660be · Correção
• https://twitter.com/CVEnew/status/2030747899441910257 · Publicação no Twitter
• https://vuldb.com/?ctiid.349582 · Nota
• https://vuldb.com/?id.349582 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3680 · Nota de Segurança
• https://vuldb.com/?submit.765399 · Nota
• https://t.me/CVEtracker/46763 · Publicação no Telegram
• https://github.com/RyuzakiShinji/biome-mcp-server · Nota
• https://t.me/cveNotify/154631 · Publicação no Telegram