DesktopCommanderMCP vulnerabilities

A vulnerability was found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The impacted element is the function CommandManager of the file src/command-manager.ts. Performing manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

The wonderwhy-er DesktopCommanderMCP up to version 0.2.38 has a vulnerability in src/search-manager.ts in the start_search function. Manipulating the SearchResult[] argument leads to inefficient regular expression complexity, exploitable remotely.

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 53699bebba9950047bca16ac4dc8f0568f596aaa.

A vulnerability has been found in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The affected element is the function extractBaseCommand of the file src/command-manager.ts of the component Absolute Path Handler. Such manipulation leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor explains: "The usual use case is that AI is asked to do something, picks commands itself, and typically uses simple command names without absolute paths. It's curious why a user would ask the model to bypass restrictions this way. (...) This could potentially be a problem, but we are yet to hear reports of this being an issue in actual workflows. We'll leave this issue open for situations where people may report this as a problem for the long term."

A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. The vulnerability affects the isPathAllowed function in src/tools/filesystem.ts and involves symlink following. The attack can only be performed locally, with high complexity and difficult exploitability, but the exploit has been publicly disclosed. The vendor explains that restriction features are guardrails for LLMs, not hardened security boundaries, and recommends using Desktop Commander with Docker for isolation. This vulnerability only affects products no longer supported by the maintainer.