Executive Summary

The vulnerability CVE-2026-10691 is a Regular Expression Denial of Service (ReDoS) issue in the DesktopCommanderMCP tool, specifically in the search functionality for Excel (.xlsx) and DOCX (.docx) files.

It occurs because user-supplied regular expression patterns are compiled directly into JavaScript RegExp objects without safeguards against catastrophic backtracking. Malicious regex patterns like (a+)+$ can cause the Node.js event loop to block indefinitely at 100% CPU usage, making the server unresponsive.

The vulnerable code is located in the functions searchExcelFiles and searchDocxFiles within the src/search-manager.ts file. The attack can be triggered remotely, for example, via prompt injection in an AI agent integrated with DesktopCommanderMCP.

A fix was introduced by adding functions to detect unsafe regex patterns and fallback to safe literal matching, preventing the ReDoS attack.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the DesktopCommanderMCP server to become completely unresponsive by consuming 100% CPU indefinitely when processing malicious regular expression patterns.

An attacker can remotely trigger this denial of service condition, effectively causing a service outage or disruption in the search functionality for Excel and DOCX files.

This can impact availability of the service, potentially interrupting workflows that depend on the search feature and causing downtime until the service is restarted or patched.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a Regular Expression Denial of Service (ReDoS) in the DesktopCommanderMCP tool when searching content within Excel (.xlsx) or DOCX (.docx) files using unsafe regex patterns. Detection can be done by monitoring for unusually high CPU usage or server unresponsiveness during search operations involving these file types.

Specifically, if the Node.js event loop is blocked at 100% CPU during search requests, especially when regex patterns like (a+)+$ are used, it indicates the presence of this vulnerability being exploited.

To detect this on your system, you can monitor the DesktopCommanderMCP process CPU usage and responsiveness. For example, on a Linux system, you might use commands like:

• top or htop - to monitor CPU usage of the DesktopCommanderMCP process.
• ps aux | grep DesktopCommanderMCP - to find the process ID.
• strace -p <pid> - to trace system calls of the process if it is stuck.
• netstat -anp | grep <pid> - to check network connections related to the process.

Additionally, reviewing logs for search requests containing suspicious or complex regex patterns can help identify attempts to exploit this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and immediate mitigation step is to upgrade DesktopCommanderMCP to version 0.2.39 or later, which includes security enhancements that protect against this ReDoS vulnerability.

This update introduces safe regex handling by validating user-supplied patterns and falling back to literal string matching when unsafe patterns are detected, preventing the server from hanging.

If upgrading immediately is not possible, consider limiting or sanitizing user input for regex patterns, enforcing regex execution timeouts, or disabling regex-based searches on Excel and DOCX files to reduce risk.

Monitoring system performance and terminating any processes stuck at high CPU usage due to regex evaluation can also help mitigate ongoing attacks.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-10691 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0