Vulnerability · Published Aug 6, 2026 · Assigned by VulDB

CVE-2026-19044LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection

Medium 5.3

In plain English

A medium-severity command injection in godot-mcp from LeeSinLiang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.9%top 41.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
LeeSinLiang	godot-mcp	0.1.0

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-386486 | LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection vdb-entry, technical-description
VDB-386486 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19044 | CVE Analysis and Report third-party-advisory
Submit #863832 | LeeSinLiang godot-mcp unknown Command Injection third-party-advisory
https://github.com/LeeSinLiang/godot-mcp/issues/1 issue-tracking
https://github.com/LeeSinLiang/godot-mcp/ product