Log in Start free

Vulnerability · Published Jun 2, 2026 · Assigned by VulDB

CVE-2026-10690wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in DesktopCommanderMCP from wonderwhy-er. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 87.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@wonderwhy-er/desktop-commanderno fix listedGHSA-5xx3-j724-wmx5

Affected products (as reported)

VendorProductVersions
wonderwhy-er DesktopCommanderMCP 0.2.37

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References