CVE-2025-11489
MediumCVSS 4.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The vulnerability affects the isPathAllowed function in src/tools/filesystem.ts and involves symlink following. The attack can only be performed locally, with high complexity and difficult exploitability, but the exploit has been publicly disclosed. The vendor explains that restriction features are guardrails for LLMs, not hardened security boundaries, and recommends using Desktop Commander with Docker for isolation. This vulnerability only affects products no longer supported by the maintainer.
Risk Assessment
A local attacker could exploit symlink following to access files outside the intended scope. The risk is limited due to the local nature and high complexity, but the public exploit increases the likelihood of exploitation.
Recommendation
Update DesktopCommanderMCP to a version later than 0.2.13 if available, or consider using Docker for isolation as recommended by the vendor. Since the product is no longer supported, consider migrating to an alternative solution.
Other vulnerabilities in DesktopCommanderMCP
See all- CVE-2025-11491Medium
A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
- CVE-2026-10691Medium
The wonderwhy-er DesktopCommanderMCP up to version 0.2.38 has a vulnerability in src/search-manager.ts in the start_search function. Manipulating the SearchResult[] argument leads to inefficient regular expression complexity, exploitable remotely.
- CVE-2026-10690Medium
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa.
- CVE-2025-11490Medium
A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor explains: "The usual use case is that AI is asked to do something, picks commands itself, and typically uses simple command names without absolute paths. It's curious why a user would ask the model to bypass restrictions this way. (...) This could potentially be a problem, but we are yet to hear reports of this being an issue in actual workflows. We'll leave this issue open for situations where people may report this as a problem for the long term."
Original NVD description (English source)
A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performed from a local environment. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The vendor explains: "Our restriction features are designed as guardrails for LLMs to help them stay closer to what users want, rather than hardened security boundaries. (...) For users where security is a top priority, we continue to recommend using Desktop Commander with Docker, which provides actual isolation. (...) We'll keep this issue open for future consideration if we receive more user demand for improved restrictions." This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS