CVE-2026-5603: @elgentos/magento2-dev-mcp vulnerable to command injection
A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The name of the patch is aa1ffcc0aea1b212c69787391783af27df15ae9d. A patch should be applied to remediate this issue.
References
- github.com/advisories/GHSA-xqv9-qr76-hfq2
- github.com/elgentos/magento2-dev-mcp
- github.com/elgentos/magento2-dev-mcp/commit/aa1ffcc0aea1b212c69787391783af27df15ae9d
- github.com/elgentos/magento2-dev-mcp/issues/4
- github.com/elgentos/magento2-dev-mcp/pull/5
- github.com/user-attachments/files/25895777/magento2-dev-mcp_bug.pdf
- nvd.nist.gov/vuln/detail/CVE-2026-5603
- vuldb.com/submit/784864
- vuldb.com/vuln/355395
- vuldb.com/vuln/355395/cti
Code Behaviors & Features
Detect and mitigate CVE-2026-5603 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →