Live › vulnerability › CVE-2026-106765
Go to dashboard@rog0x/mcp-docker-tools 1.0.1 (a small MCP server for Docker, about 5 weekly downloads) passes the docker_image_list 'filter' argument straight into a shell command via execSync. Whoever controls that argument, for example through prompt injection into the agent, can run commands on the host. No fix has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running @rog0x/mcp-docker-tools as an MCP server for a coding agent or AI client on a machine with Docker. The server runs over stdio as a local process. Exposure comes from untrusted content (prompt injection) steering the agent into calling docker_image_list with a crafted filter, which executes as the user running the server. Teams that do not have this package can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @rog0x/mcp-docker-tools | npm | 1.0.1 (1.0.0 likely, unconfirmed) | – |
1.0.0 and 1.0.1)filter against a repository-name patternEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
This page as .md · .json · in your agent: get_signal("CVE-2026-106765")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.