Vulnerability · Published Apr 2, 2026 · Assigned by VulDB

CVE-2026-5327efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection

Medium 6.3

In plain English

A medium-severity command injection in fast-filesystem-mcp from efforthye. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)1.2%top 30.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index.ts. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	fast-filesystem-mcp	no fix listed	GHSA-5226-3rvg-hp4x

Affected products (as reported)

Vendor	Product	Versions
efforthye	fast-filesystem-mcp	3.5.03.5.1

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-354658 | efforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injection vdb-entry, technical-description
VDB-354658 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #780776 | efforthye fast-filesystem-mcp <= 3.5.1 Command Injection third-party-advisory
https://github.com/efforthye/fast-filesystem-mcp/issues/15 issue-tracking
https://github.com/user-attachments/files/25822878/fast-filesystem-mcp_bug.pdf exploit
https://github.com/efforthye/fast-filesystem-mcp/ product