| 标题 | efforthye fast-filesystem-mcp <= 3.5.1 Command Injection |
|---|
| 描述 | A command injection vulnerability exists in efforthye/fast-filesystem-mcp due to unsafe use of child_process.execAsync when constructing shell commands with user-controlled input. Successful exploitation allows attackers to execute arbitrary shell commands with the privileges of the MCP server process. |
|---|
| 来源 | ⚠️ https://github.com/efforthye/fast-filesystem-mcp/issues/15 |
|---|
| 用户 | Yinci Chen (UID 94659) |
|---|
| 提交 | 2026-03-16 12時39分 (7 月前) |
|---|
| 管理 | 2026-04-01 15時27分 (16 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 354658 [efforthye fast-filesystem-mcp 直到 3.5.1 src/index.ts handleGetDiskUsage 权限提升] |
|---|
| 积分 | 18 |
|---|