Vulnerability · Published Aug 9, 2026 · Assigned by VulDB

CVE-2026-19333NightTrek Supabase-MCP generate_types command injection

Medium 5.3

In plain English

A medium-severity command injection in Supabase-MCP from NightTrek. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.1%top 34.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issue is some unknown functionality of the component generate_types. The manipulation of the argument schema results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
NightTrek	Supabase-MCP	cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170db03237d92f7dc2f0da0d70a87dba84ebcde5b66

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-387169 | NightTrek Supabase-MCP generate_types command injection vdb-entry, technical-description
VDB-387169 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19333 | CVE Analysis and Report third-party-advisory
Submit #865256 | NightTrek Supabase-MCP unknown Command Injection third-party-advisory
https://github.com/NightTrek/Supabase-MCP/issues/2 issue-tracking
https://github.com/NightTrek/Supabase-MCP/ product