Approved changes feed: RSS · Atom
cpe:2.3:a:coding-solo:godot-mcp:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Coding Solo (08542d24-6f14-5684-9fbd-02a60864a2df) |
|---|---|
| Product | Godot Mcp (6a2ff23c-c189-5470-b2ea-88179c800d85) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-25546 |
vulnerable | 2026-06-08 07:53:19.981513 |
Godot MCP is vulnerable to Command Injection via unsanitized projectPath
HIGH (7.8)
Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input (e.g., projectPath) directly to exec(), which spawns a shell. An attacker could inject shell metacharacters like $(command) or &calc to execute arbitrary commands with the privileges of the MCP server process. This affects any tool that accepts projectPath, including create_scene, add_node, load_sprite, and others. This issue has been patched in version 0.1.1.
Published: 2026-02-04T21:48:53.225Z
Updated: 2026-02-05T17:51:29.147Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.