CVE-2026-19041

MediumCVSS 6.3

Published: 06/08/2026(UTC)Updated: 23/10/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.12%

82th percentile - higher than 82% of all known CVEs

Summary

A command injection vulnerability was found in MissionSquad mcp-api up to version 1.11.8 in the this.packageService.installPackage function in src/controllers/packages.ts, in the NPM Package Version Handler component. The attack can be initiated remotely. Upgrading to version 1.11.9 resolves the issue.

Risk Assessment

A remote attacker could execute arbitrary commands on the server, potentially leading to full system compromise.

Recommendation

Immediately update to version 1.11.9 or later.

Other vulnerabilities in MissionSquad mcp-api

CVE-2026-19040Medium
A server-side request forgery (SSRF) vulnerability was found in MissionSquad mcp-api up to version 1.11.9 in an unknown function in src/services/dcrClients.ts. The attack may be performed remotely. Upgrading to version 1.11.10 fixes the issue.

Original NVD description (English source)

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiate the attack remotely. Upgrading to version 1.11.9 is sufficient to resolve this issue. The identifier of the patch is a40f54d4533ba6618e1749383a245900eeb024c1. The affected component should be upgraded.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS