CVE-2026-19284
Received Received - Intake

Command Injection in MauricioMilano coder-api

Publication date: 2026-08-08

Last updated on: 2026-08-08

Assigner: VulDB

Description
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-08
Last Modified
2026-08-08
Generated
2026-08-08
AI Q&A
2026-08-08
EPSS Evaluated
N/A
NVD
CVE-2026-19284
EUVD
EUVD-2026-54784

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mauriciomilano coder-api to 1.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19284 is a command injection vulnerability in the MauricioMilano coder-api up to version 1.1.0. It affects the createProject function in src/core/projects.ts, allowing local attackers to inject and execute arbitrary shell commands through manipulated Git clone parameters like branch, depth, or URL.

Detection Guidance

Check for suspicious Git clone operations in logs, especially those using the Projects Endpoint. Look for unusual branch, depth, or URL parameters in requests to POST /projects or MCP create-project. Monitor for unexpected file creation in temporary directories or system-wide locations.

Impact Analysis

This vulnerability allows attackers with local access to execute arbitrary commands on the system running the coder-api server. This could lead to unauthorized file access, data theft, or system compromise depending on the server's privileges.

Mitigation Strategies

Disable the Projects Endpoint if possible. Update to a patched version replacing child_process.exec with safer alternatives like spawn or execFile. Implement strict input validation for Git parameters using allowlists. Ensure sandboxing is enforced and isolate the API from external services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19284. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart