PT-2026-23889 · Ryuzakishinji · Biome-Mcp-Server

Yinci Chen · Published 2026-03-07 · Updated 2026-03-08 · CVE-2026-3680

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RyuzakiShinji biome-mcp-server versions up to 1.0.0

Description A security flaw exists in RyuzakiShinji biome-mcp-server up to version 1.0.0, related to an unknown functionality within the biome-mcp-server.ts file. A manipulation of this functionality can lead to command injection, and the attack can be initiated remotely. The exploit has been publicly released.

Recommendations Apply patch 335e1727147efeef011f1ff8b05dd751d8a660be.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-3680

Affected Products

Biome-Mcp-Server

References · 11

• 🔥❌ https://github.com/user-attachments/files/25466715/biome-mcp-server_security_advisory.pdf · Exploit, Deleted
• https://github.com/RyuzakiShinji/biome-mcp-server/pull/1 · Patch
• https://github.com/RyuzakiShinji/biome-mcp-server/pull/1/changes/335e1727147efeef011f1ff8b05dd751d8a660be · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3680 · Security Note
• https://twitter.com/CVEnew/status/2030747899441910257 · Twitter Post
• https://vuldb.com/?ctiid.349582 · Note
• https://vuldb.com/?id.349582 · Note
• https://vuldb.com/?submit.765399 · Note
• https://t.me/CVEtracker/46763 · Telegram Post
• https://github.com/RyuzakiShinji/biome-mcp-server · Note
• https://t.me/cveNotify/154631 · Telegram Post