| शीर्षक | suvarchal docker-mcp-server 0.1.0 Command Injection |
|---|
| विवरण | A command injection vulnerability (CWE-78) has been identified in docker-mcp-server, specifically within the src/index.ts component. Multiple MCP tool handlers—including stop_container, remove_container, and pull_image—construct shell command strings using unsanitized attacker-controlled input (e.g., container names or image tags) and execute them via execAsync. An attacker with network access to the MCP/HTTP interface can supply malicious input containing shell metacharacters, leading to arbitrary OS command execution with the privileges of the server process. This can result in full host compromise, including data exposure, integrity loss, and service disruption. Versions up to and including 0.1.0 are confirmed affected. |
|---|
| स्रोत | ⚠️ https://github.com/suvarchal/docker-mcp/issues/3 |
|---|
| उपयोगकर्ता | BruceJin (UID 96538) |
|---|
| सबमिशन | 24/03/2026 09:45 AM (7 महीनों पहले) |
|---|
| संयम | 07/04/2026 03:42 PM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355748 [suvarchal docker-mcp-server तक 0.1.0 HTTP Interface src/index.ts stop_container/remove_container/pull_image अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|