DesktopCommanderMCP vulnerabilities

3 known vulnerabilities in DesktopCommanderMCP from Wonderwhy-er. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  DesktopCommanderMCP: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-11491Oct 8, 2025Wonderwhy-erEPSS 4.3%

  A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack r

• 9.8 Critical severity

  DesktopCommanderMCP: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-11490Oct 8, 2025Wonderwhy-erEPSS 3.54%

  A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection.

• 7.0 High severity

  DesktopCommanderMCP: Improper Link Resolution Before File Access

  CVE-2025-11489Oct 8, 2025Wonderwhy-er

  A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performe