CVE-2026-5603
OS Command Injection in elgentos magento2-dev-mcp executeMagerun2Command
Publication date: 2026-04-05
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elgentos | magento2-dev-mcp | to 1.0.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should apply the patch named aa1ffcc0aea1b212c69787391783af27df15ae9d.
Since the attack requires local access, restricting local access to trusted users can also help reduce risk.
Can you explain this vulnerability to me?
This vulnerability exists in the elgentos magento2-dev-mcp software up to version 1.0.2, specifically in the function executeMagerun2Command within the file src/index.ts.
It allows an attacker to perform OS command injection, meaning they can execute arbitrary operating system commands through this function.
The attack requires local access to the system, and an exploit for this vulnerability is publicly available.
A patch identified by the commit aa1ffcc0aea1b212c69787391783af27df15ae9d should be applied to fix this issue.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with local access to execute arbitrary operating system commands on the affected system.
Such command injection can lead to unauthorized actions, potentially compromising the integrity, confidentiality, and availability of the system.
Because the exploit is publicly available, the risk of exploitation is higher if the system is not patched.