PT-2026-6954 · Burtthecoder · Mcp-Maigret

Lexpl0It · Publicado 2026-02-08 · Atualizado 2026-02-08 · CVE-2026-2130

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BurtTheCoder mcp-maigret versions through 1.0.12

Description A flaw exists in the component search username within the file src/index.ts. Manipulating the Username argument can result in command injection, potentially allowing for remote attacks.

Recommendations Upgrade to version 1.0.13 to address this issue.

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2026-2130

GHSA-2G7V-HGHF-GRG4

Produtos afetados

Mcp-Maigret

Referências · 14

• https://github.com/BurtTheCoder/mcp-maigret/commit/b1ae073c4b3e789ab8de36dc6ca8111ae9399e7a · Correção
• https://github.com/BurtTheCoder/mcp-maigret/pull/10 · Correção
• https://github.com/BurtTheCoder/mcp-maigret/releases/tag/v1.0.13 · Correção
• https://github.com/BurtTheCoder/mcp-maigret · Nota
• https://github.com/BurtTheCoder/mcp-maigret/issues/9 · Nota
• https://t.me/cveNotify/151277 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-2130 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2g7v-hghf-grg4 · Aviso do Fabricante
• https://vuldb.com/?id.344765 · Nota
• https://vuldb.com/?ctiid.344765 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2130 · Nota de Segurança
• https://vuldb.com/?submit.747171 · Nota
• https://twitter.com/CVEnew/status/2020356545179979782 · Publicação no Twitter
• https://t.me/CVEtracker/44080 · Publicação no Telegram