NewApp Monitoring is liveSign up free
AgentbeamBeta
AI agent vulnerability · Other MCP servers and tools

CVE-2026-5603: @elgentos/magento2-dev-mcp vulnerable to command injection

lowCVSS 4.0 1.9 · 3.1 5.3GHSA-xqv9-qr76-hfq2

A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The name of the patch is aa1ffcc0aea1b212c69787391783af27df15ae9d. A patch should be applied to remediate this issue.

Published Apr 6, 2026

Affected packages

@elgentos/magento2-dev-mcp

Ecosystem
npm
Affected
<= 1.0.2
Fixed in
No patched version yet
Check
npm ls @elgentos/magento2-dev-mcp

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The name of the patch is aa1ffcc0aea1b212c69787391783af27df15ae9d. A patch should be applied to remediate this issue.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries