{"id":"CVE-2026-106765","kind":"vulnerability","aliases":["CVE-2026-106765"],"related":[],"title":"mcp-docker-tools: flaw in image listing lets remote attacker run code","description":"An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.","summary":"@rog0x/mcp-docker-tools 1.0.1 (a small MCP server for Docker, about 5 weekly downloads) passes the docker_image_list 'filter' argument straight into a shell command via execSync. Whoever controls that argument, for example through prompt injection into the agent, can run commands on the host. No fix has been published.","severity":"high","cvss":7.5,"epss":0.00699,"exploited":false,"exploited_at":null,"products":[{"name":"@rog0x/mcp-docker-tools","fixed":[],"affected":"1.0.1 (1.0.0 likely, unconfirmed)","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","command-injection","docker","mcp","node.js","npm","stdio"],"not_affected_if":["docker_image_list-tool-disabled","package-not-installed"],"how_to_check":"- Run npm ls @rog0x/mcp-docker-tools, or search package.json, lockfiles and MCP client configs (claude_desktop_config.json, .claude/settings.json, .mcp.json) for mcp-docker-tools\n- Installed version 1.0.0 or 1.0.1 is exposed; the code in src/tools/image-list.ts appends 'filter' to the command with execSync","fix":"No fixed version as of 2026-10-25 (npm lists only 1.0.0 and 1.0.1). Remove the server from your MCP config or uninstall it until the maintainer patches it. If you fork it, pass arguments with execFile/spawn and no shell, and validate 'filter' against a repository-name pattern.","status":"open","published_at":"2026-10-23T15:17:23+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:14:50+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:14:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"mcp-docker-tools: flaw in image listing lets remote attacker run code","impact":"high","summary":"The npm package @rog0x/mcp-docker-tools 1.0.1, an MCP server for managing Docker, has a flaw in its handleImageList function that allows arbitrary code execution. A remote attacker could run code on the host where the server runs.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","npm","docker","node.js"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Remote attacker executes arbitrary code on the host running the server","analyst_note":"Check the NVD entry and the package repository for the vulnerable input path, whether a fixed version exists, and the transport the server uses.","how_to_check":"- Look for `@rog0x/mcp-docker-tools` in `package.json` or lockfiles and check the installed version with `npm ls @rog0x/mcp-docker-tools`\n- Check whether version `1.0.1` is in use","needs_analyst":true,"not_affected_if":["package-not-installed"],"who_is_affected":"Teams that installed @rog0x/mcp-docker-tools 1.0.1 as an MCP server for Docker, typically wired into a coding agent or AI client. The sources do not say whether exposure depends on network binding or transport, so treat any running instance as exposed until confirmed. Teams without this package can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000599,"input_tokens":3282,"output_tokens":541,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the package repository for the vulnerable input path, whether a fixed version exists, and the transport the server uses.","search":"'-106765':16A,19A '-2026':15A,18A '1.0.1':33B,85C '5':41B 'agent':69B 'ai':22B 'ai-tool':21B 'allow':86C 'arbitrari':92C 'argument':50B,61B 'attack':11A,89C 'code':13A,93C 'command':25B,55B,72B 'command-inject':24B 'control':59B 'cve':14A,17A 'docker':3A,27B,39B,46B 'download':43B 'exampl':63B 'execsync':57B 'execut':91C 'filter':49B 'fix':77B 'flaw':5A 'function':97C 'handleimagelist':96C 'host':75B 'imag':7A,47B 'inject':26B,66B 'issu':82C 'let':9A 'list':8A,48B 'mcp':2A,28B,36B 'mcp-docker-tool':1A 'node.js':29B 'npm':30B 'pass':44B 'prompt':65B 'publish':80B 'remot':10A,88C 'rog0x/mcp-docker-tools':20A,32B,84C 'run':12A,71B 'server':37B 'shell':54B 'small':35B 'stdio':31B 'straight':51B 'tool':4A,23B 'via':56B,94C 'week':42B 'whoever':58B","nicknames":[],"mitigations":[],"who_affected":"Anyone running @rog0x/mcp-docker-tools as an MCP server for a coding agent or AI client on a machine with Docker. The server runs over stdio as a local process. Exposure comes from untrusted content (prompt injection) steering the agent into calling docker_image_list with a crafted filter, which executes as the user running the server. Teams that do not have this package can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106765","severity":null,"published_at":"2026-10-23T15:17:23+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106765:681","url":null,"severity":null,"published_at":"2026-10-25T03:16:23+00:00","modified_at":"2026-10-25T03:16:23+00:00","first_seen_at":"2026-10-25T03:16:23+00:00","fetched_at":"2026-10-25T03:16:23+00:00","note":"No vendor advisory exists; read the repo source (master): handleImageList appends the model-supplied 'filter' arg unsanitized into a docker images shell string run via execSync = command injection (CWE-94/78). Transport is stdio (local node command in Claude Desktop/Code config). No fixed version: npm has only 1.0.0 and 1.0.1, no patch seen. No PoC, no exploitation, no discussion found. Nothing marked verified (no maintainer advisory)."},{"source":"epss","external_id":"CVE-2026-106765","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106765","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":3096,"url":"https://raw.githubusercontent.com/rog0x/mcp-docker-tools/master/src/tools/image-list.ts","title":"mcp-docker-tools src/tools/image-list.ts (handleImageList)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3097,"url":"https://registry.npmjs.org/@rog0x/mcp-docker-tools","title":"npm: @rog0x/mcp-docker-tools (versions 1.0.0, 1.0.1)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3099,"url":"https://github.com/rog0x/mcp-docker-tools","title":"rog0x/mcp-docker-tools repository","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}