Vulnerability · Published Oct 8, 2025 · Assigned by VulDB
CVE-2025-11491wonderwhy-er DesktopCommanderMCP command-manager.ts CommandManager os command injection
Medium 6.3
In plain English
A medium-severity OS command injection in DesktopCommanderMCP from wonderwhy-er. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)4.3%top 8.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wonderwhy-er | DesktopCommanderMCP | 0.2.00.2.10.2.20.2.30.2.40.2.50.2.60.2.7 |
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-327610 | wonderwhy-er DesktopCommanderMCP command-manager.ts CommandManager os command injection vdb-entry, technical-description
- VDB-327610 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #668006 | wonderwhy-er DesktopCommanderMCP 0.2.13 Improper Neutralization third-party-advisory
- https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217 issue-tracking
- https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217#issue-3343853704 exploit, issue-tracking