Live › vulnerability › CVE-2026-113378
Go to dashboardThe mcp-ripgrep MCP server (up to 0.4.0) passes the fileType argument to a shell command without the escaping applied to its other arguments. An attacker who can supply that argument can run arbitrary OS commands with the privileges of the process running the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run the mcp-ripgrep MCP server, typically wired into a coding agent or chat client on a developer machine. The attack path is described as local, and the maintainer's own docs say the server runs shell commands and to use caution with input. Teams not running this package can skip it.
No product ranges from the sources yet.
package.json or the npx cache) and see whether it is 0.4.0 or older.src/index.ts for the fileType argument being concatenated into a shell command without escapeShellArg.claude_desktop_config.json, .mcp.json, or similar) starts mcp-ripgrep.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The real existence of this vulnerability is still doubted at the moment. The code's own escapeShellArg on sibling arguments (skipped only for fileType) indicates that this is a CWE-78 oversight, not a documented design. The project maintainer cites the documentation: "This MCP server executes shell commands using the ripgrep tool. While efforts have been made to safely escape arguments, use caution when providing input, as it runs commands on your machine."
This page as .md · .json · in your agent: get_signal("CVE-2026-113378")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.