---
id: "CVE-2026-106765"
kind: "vulnerability"
aliases: ["CVE-2026-106765"]
title: "mcp-docker-tools: flaw in image listing lets remote attacker run code"
severity: "high"
cvss: 7.5
epss: 0.00699
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "@rog0x/mcp-docker-tools", "fixed": [], "affected": "1.0.1 (1.0.0 likely, unconfirmed)", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "command-injection", "docker", "mcp", "node.js", "npm", "stdio"]
not_affected_if: ["docker_image_list-tool-disabled", "package-not-installed"]
published_at: "2026-10-23T15:17:23+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106765", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:16:23+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-106765", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# mcp-docker-tools: flaw in image listing lets remote attacker run code

@rog0x/mcp-docker-tools 1.0.1 (a small MCP server for Docker, about 5 weekly downloads) passes the docker_image_list 'filter' argument straight into a shell command via execSync. Whoever controls that argument, for example through prompt injection into the agent, can run commands on the host. No fix has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@rog0x/mcp-docker-tools affected 1.0.1 (1.0.0 likely, unconfirmed) fixed ?

## How to check

- Run npm ls @rog0x/mcp-docker-tools, or search package.json, lockfiles and MCP client configs (claude_desktop_config.json, .claude/settings.json, .mcp.json) for mcp-docker-tools
- Installed version 1.0.0 or 1.0.1 is exposed; the code in src/tools/image-list.ts appends 'filter' to the command with execSync

## Fix

No fixed version as of 2026-10-25 (npm lists only 1.0.0 and 1.0.1). Remove the server from your MCP config or uninstall it until the maintainer patches it. If you fork it, pass arguments with execFile/spawn and no shell, and validate 'filter' against a repository-name pattern.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106765
- 2026-10-25T03:16:23+00:00 analyst — No vendor advisory exists; read the repo source (master): handleImageList appends the model-supplied 'filter' arg unsanitized into a docker images shell string run via execSync = command injection (CWE-94/78). Transport is stdio (local node command in Claude Desktop/Code config). No fixed version: npm has only 1.0.0 and 1.0.1, no patch seen. No PoC, no exploitation, no discussion found. Nothing marked verified (no maintainer advisory).
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-106765

## Documents

- [describes] mcp-docker-tools src/tools/image-list.ts (handleImageList) https://raw.githubusercontent.com/rog0x/mcp-docker-tools/master/src/tools/image-list.ts
- [mentions] npm: @rog0x/mcp-docker-tools (versions 1.0.0, 1.0.1) https://registry.npmjs.org/@rog0x/mcp-docker-tools
- [mentions] rog0x/mcp-docker-tools repository https://github.com/rog0x/mcp-docker-tools

## From the sources

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_