VulnerabilityDeferred
CVE-2026-10690
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37.
LOW 2.1EPSS 0.22%
Does this matter?
Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa. It is best practice to apply a patch to resolve this issue.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.22% probability · 13th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Source
- cna@vuldb.com
References
- https://github.com/sorlen008/DesktopCommanderMCP/commit/53699bebba9950047bca16ac4dc8f0568f596aaa
- https://github.com/wonderwhy-er/DesktopCommanderMCP/
- https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/410
- https://vuldb.com/cve/CVE-2026-10690
- https://vuldb.com/submit/830735
- https://vuldb.com/vuln/367959
- https://vuldb.com/vuln/367959/cti
- https://vuldb.com/submit/830735
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.